Security audit

Tmp.6swodUvLYL

Security checks across malware telemetry and agentic risk

Overview

This Resy skill is clearly for reservation management, but it can book or cancel real reservations without documenting explicit confirmation safeguards.

Install only if you are comfortable storing Resy credentials in MCP configuration and using an unofficial Resy API client. Add your own operating rule that the agent must confirm the exact venue, date, time, party size, and reservation before booking or canceling.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger description ends with a broad catch-all phrase covering essentially any request involving restaurant reservations on Resy, which can cause the skill to activate in situations the user did not explicitly intend. Because this skill can access account data and perform state-changing actions like booking, canceling, and notification subscriptions, overbroad activation increases the chance of unauthorized or mistaken use.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill documents direct reservation cancellation but does not state that cancellation requires an explicit user confirmation step. Since `resy_cancel` is a destructive action that affects real reservations, omission of a confirmation expectation creates a meaningful risk of accidental cancellations from ambiguous prompts, mis-triggering, or agent mistakes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.