ClawHub
Back to skill

Security audit

Tmp.6swodUvLYL

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for Resy reservations, but it asks users to run an unpinned MCP package with live Resy credentials and enables real account changes without clear confirmation safeguards.

Review carefully before installing. Prefer a pinned, reviewed local install over npx -y, keep credentials out of project files and source control, restrict file permissions, and require explicit confirmation before booking, canceling, changing favorites, or creating Priority Notify subscriptions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:19
Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–33
Vulnerability Type: Supply-chain exposure through automatic execution of an unpinned package
Risk Level: High

Complete Code Snippet

json
Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

{
  "mcpServers": {
    "resy": {
      "command": "npx",
      "args": ["-y", "resy-mcp"],
      "env": {
        "RESY_EMAIL": "you@example.com",
        "RESY_PASSWORD": "yourpassword"
      }
    }
  }
}

Technical Analysis

The recommended configuration runs npx -y resy-mcp without specifying an exact package version or verifying package integrity. When invoked, npx may retrieve the package currently associated with the resy-mcp name from the configured npm registry and execute it without an interactive installation confirmation.

The effective executable can therefore change after this Skill has been reviewed. Compromise of the package publisher, npm account, registry resolution, or a subsequently published package version could introduce arbitrary code. The -y option removes an important opportunity for the operator to inspect or reject a newly downloaded version.

This behavior exceeds the minimum privilege necessary for repeatable operation. The MCP server can be installed from a reviewed, pinned artifact rather than resolving mutable code whenever it is launched.

Attack Path

  1. An attacker compromises the resy-mcp publisher account, package, or applicable npm registry resolution.
  2. The attacker publishes a malicious version under the same package name.
  3. A user starts the configured MCP server.
  4. npx -y resy-mcp resolves and downloads the attacker-controlled release without version pinning or confirmation.
  5. The malicious package executes with the privileges of the user running the agent.
  6. Because the process receives RESY_EMAIL and RESY_PASSWORD, malicious package code can read t ...[truncated 591 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the package to a specific reviewed version, for example resy-mcp@X.Y.Z, rather than resolving the latest release.
  • Prefer a lockfile-backed local installation and invoke the installed executable directly.
  • Verify the package with npm integrity metadata, provenance information, and a reviewed dependency lockfile.
  • Remove -y where interactive approval is practical.
  • Run the MCP server under a dedicated, restricted operating-system account or sandbox with narrowly scoped filesystem and network access.
  • Establish an explicit update process in which new versions are reviewed and tested before the pin is changed.
  • Avoid providing credentials to a newly resolved package until its source and published artifact have been verified.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Plaintext Resy Password Is Stored in MCP Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–33
Vulnerability Type: Plaintext credential storage in project or user configuration
Risk Level: Medium

Complete Code Snippet

json
Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

{
  "mcpServers": {
    "resy": {
      "command": "npx",
      "args": ["-y", "resy-mcp"],
      "env": {
        "RESY_EMAIL": "you@example.com",
        "RESY_PASSWORD": "yourpassword"
      }
    }
  }
}

Technical Analysis

The setup instructions direct users to place their Resy email address and account password directly into .mcp.json. A project-level .mcp.json can accidentally be committed to source control, copied into archives, included in support bundles, or exposed to other users and processes with read access. The alternative recommendation to use a project .env file has similar risks unless permissions and source-control exclusions are configured correctly.

The MCP process necessarily needs authentication material because the documented private API uses email-and-password login. Sending authentication information to Resy's authentication endpoint is consistent with the declared functionality. However, retaining the reusable account password in plaintext configuration is broader and longer-lived than necessary and increases exposure compared with secret-manager injection or a narrowly scoped token.

The short-lived slot config_token described at line 134 is operational data required for booking and is refreshed internally. The documentation does not show that token being sent to an unrelated destination, so that specific behavior is not evidence of credential exfiltration.

Attack Path

  1. A user follows the instructions and writes valid Resy credentials into a project-level or home-directory MCP configuration.
  2. The file is committed to a repository, synchronized to shared storage, captured in a backup, inc ...[truncated 889 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not place reusable passwords directly in project .mcp.json files.
  • Integrate with an operating-system keychain, MCP-supported secret provider, or dedicated secrets manager and inject the values only at process startup.
  • If environment variables are unavoidable, populate them from a protected external secret source rather than a committed configuration file.
  • Add .mcp.json and .env to .gitignore and provide sanitized .example templates containing placeholders only.
  • Require restrictive file permissions, such as owner-read/write only, for any local file containing credentials.
  • Warn users not to include credential-bearing configuration in repositories, logs, screenshots, backups, or support bundles.
  • Prefer a revocable, narrowly scoped token over the account password if the service or implementation later supports one.
  • Document password rotation and session revocation procedures for suspected exposure.
  • Run the MCP process with least privilege so unrelated local processes and users cannot access its configuration or environment.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Option A — npx (recommended)

Add to .mcp.json in your project or ~/.claude/mcp.json:

json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description ends with a broad catch-all phrase covering 'any request involving restaurant reservations on Resy,' which can cause the skill to activate in situations beyond the user's clear intent. Because this skill performs state-changing actions like booking, canceling, and subscribing to notifications, overbroad activation increases the chance of unintended account actions or sensitive reservation data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The workflow examples show booking and cancellation operations but do not prominently warn that these tools can create, modify, or cancel live reservations on a real user account. In a transactional context, missing warnings can mislead users or downstream agents into treating examples as informational rather than state-changing, increasing the risk of accidental bookings or cancellations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.