Security audit

Tmp.XuBXJbJg0f

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for OpenTable reservation management, but it needs review because it uses a signed-in browser session for real booking and cancellation actions with sensitive reservation/profile data and incomplete confirmation controls.

Install only if you are comfortable giving this MCP and its browser extension access to your signed-in OpenTable session. Use a dedicated browser profile if possible, verify the package and extension publisher/version yourself, and require explicit confirmation before any booking, modification, cancellation, or favorites change.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:21
Finding: Unpinned Third-Party Packages and Browser Extension Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation
"] } ``` 2. Prefer a locally installed, reviewed package over downloading executable code during each MCP launch. 3. Publish expected package integrity hashes and verify downloaded artifacts before execution. 4. For source installations: - Reference an immutable commit hash or signed release tag. - Verify the release signature or published checksum. - Commit a reviewed lockfile. - Use `npm ci` rather than unconstrained `npm install`. - Review package lifecycle scripts before installation. 5. Link to one exact extension-store listing and document its publisher identity, reviewed version, permissions, and expected checksum where the distribution platform supports verification. 6. Pin the extension to a reviewed release and document an update-review process. 7. Run the MCP server with a restricted OS account or sandbox that cannot access unrelated files, credentials, or services. 8. Limit browser extension host permissions to the minimum OpenTable origins required for operation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:57
Finding: Excessive Exposure of Authenticated Session Data and Reservation Control Tokens
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

MCP Config Access

High

Category: Agent Snooping
Confidence: 95% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
Option A — npx (recommended)

Add to .mcp.json in your project or ~/.claude/mcp.json:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text includes 'any request involving OpenTable restaurant reservations,' which is overly broad and can cause the skill to activate on loosely related user queries. Overbroad activation increases the chance of the agent invoking reservation-management capabilities in contexts where the user did not intend account-affecting actions, especially given this skill can book, modify, cancel, and access profile data via an authenticated browser session.
Content: No source excerpt is available for this finding.

Missing User Warnings