ClawHub
Back to skill

Security audit

opentable

Security checks for vulnerabilities and agentic risk

Overview

The skill’s signed-in browser access fits its reservation-management purpose, and booking, modification, and cancellation require user approval.

Trust and preferably pin the npm package and browser-extension versions before installing. Keep reservation confirmations enabled, review card holds and cancellation fees, and protect reservation security tokens. This review covers the bundled instructions; it does not certify the separately installed server or extension.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Option A — npx (recommended)

Add to .mcp.json in your project or ~/.claude/mcp.json:

json
{

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
ontextMint app, which has no public download) — use Chrome for now.
2. Sign in to `https://www.opentable.com/` in the same browser profile.

The extension's toolbar badge turns green when the WebSocket + tab + auth are all good.

Full extension walkthrough: see [ContextMint Bridge](https://github.com/nullnet-app/contextmint-bridge).

## Authentication

No env vars are required: auth is whatever cookies your signed-in opentable.com tab has. Optional knobs (`OT_BRIDGE=mcp-chrome` for a read-only mcp-chrome transport, `OT_WS_PORT`, `OT_MCP_CHROME_URL`, and the `MCP_CONFIRM_*` family) are documented in the README's Configure and Confirmations sections. If Akamai rotates `_abck` or OpenTable's SSO expires, visit opentable.com and click through whatever prompt appears — subsequent MCP calls will use the fresh cookies automatically.

The server throws `SessionNotAuthenticatedError` (with a clear message) if it detects the sign-in interstitial.

## Tools

### Discovery
| Tool | Description

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
`<restaurant>, party of <n> — <date>T<time> | no date — <status>`, at most 120
characters, inside the untrusted-data envelope as `data: string[]` (restaurant
names are third-party text), with `-- none` when there are none (see
[In context groups](#in-context-groups)). You get the slim rung without asking for it; an
efficiency a caller has to know about and request is one that usually is not
requested, and the caller paying for it is the one least able to know it exists.