tock-fpx

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:07 PM UTC
• Version: 0.5.2

Overview

The skill is read-only and mostly purpose-aligned, but it relies on a persistent browser-session bridge and documents commands that can expose signed-in reservation identity data in unsafe local files.

Review before installing. Use only with the signed-in account holder's consent, pin and verify the fpx/extension source where possible, restrict browser site access to Tock, avoid saving reservation responses to shared /tmp paths, and delete or redact any files containing names, emails, reservation IDs, dates, or party details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31
• Finding: Unpinned Global Installation of a Browser-Session Bridge<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-33` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```sh npm install -g @fetchproxy/cli # provides `fpx` fpx profile add tock --domain exploretock.com fpx pair -p tock # prints a pair code → approve in Transporter ``` ### Technical Analysis The setup instructions globally install the latest available version of `@fetchproxy/cli` without a pinned version, lockfile, or integrity verification. The installed CLI is then paired with the Transporter browser extension and authorized to route requests through an open Tock browser tab. This bridge capability is necessary for the declared functionality because Tock is protected by a Cloudflare challenge and authenticated reservation requests require the user's browser session. However, the dependency receives security-sensitive access: it runs locally with the invoking user's privileges and processes responses obtained through a signed-in browser context. The project does not specify: - A reviewed package version. - An expected package integrity hash. - A lockfile or reproducible installation procedure. - The authoritative source and reviewed version of the Transporter extension. - A process for verifying updates before installation. Consequently, the effective implementation can change after this Skill has been audited. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a future package release. 2. A user follows the documented unpinned global installation command. 3. npm installs and executes the compromised package with the user's local privileges. 4. The user pairs the compromised CLI with the browser extension and a Tock profile. 5. Malicious dependency code accesses data passing through the bridge, abuses authorized Tock requests, reads other resources available to the local process, or sends captured data to an attac ...[truncated 832 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@fetchproxy/cli` to a specifically reviewed version rather than installing the latest release. 2. Verify the npm package integrity hash and publisher provenance before installation. 3. Provide a lockfile or another reproducible installation mechanism. 4. Prefer a project-local installation over a global installation where supported. 5. Document the official Transporter extension source, reviewed version, publisher, and minimum required permissions. 6. Restrict the bridge profile to the exact required origin, preferably `https://www.exploretock.com`, and only the necessary HTTP methods and paths if the bridge supports such controls. 7. Require explicit confirmation before authenticated reservation requests. 8. Establish an update-review process so new CLI and extension releases are audited before users install them. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/requests.md:117
• Finding: Reservation PII Written to Predictable Files in /tmp<![CDATA[ ## Vulnerability Details **File Location**: `references/requests.md:117-141` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```sh cat > /tmp/tock-reservations.json <<'JSON' { "operationName": "PatronReservationHistory", "variables": { "offset": 0, "limit": 30, "selection": "UPCOMING" }, "query": "\n query PatronReservationHistory($offset: Int!, $limit: Int!, $selection: String!) {\n purchases(offset: $offset, limit: $limit, selection: $selection) {\n id\n ...ConsumerPurchaseSummary\n }\n}\n\n fragment ConsumerPurchaseSummary on ConsumerPurchaseSummary {\n business {\n domainName\n id\n profileImages {\n altText\n backingUrl\n dominantColor\n id\n imageUrl\n }\n name\n }\n cancelledOrRefunded\n city\n country\n dinerPatron {\n email\n firstName\n lastName\n id\n }\n eligibleForFeedback\n visitFiveStarRating\n firstTransferredTo {\n id\n }\n id\n ownerPatron {\n email\n firstName\n lastName\n id\n }\n ticketCount\n ticketDateTime\n ticketType {\n deliveryServiceProvider\n descriptiveVariety\n id\n name\n reserveShippingTime\n singleUnitQuantity\n variety\n }\n}\n" } JSON fpx post-json 'https://www.exploretock.com/api/graphql/PatronReservationHistory?opname=PatronReservationHistory' \ @/tmp/tock-reservations.json -p tock > /tmp/tock-reservations-response.json jq -r '.data.purchases[] | "\(.ticketDateTime)\t\(.business.name)\t\(.ticketCount)ppl\t\(.ticketType.name)\(if .cancelledOrRefunded then " [CANCELLED]" else "" end)"' /tmp/tock-reservations-response.json ``` ### Technical Analysis The authenticated GraphQL response is redirected into the fixed path `/tmp/tock-reservations-response.json`. The response can contain personal and reservation information, including: - Customer first and last names. - Customer email addresses. - Patron and reservation identifiers. - ...[truncated 2402 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Prefer streaming the authenticated response directly into the required processor so it is not persisted: ```sh fpx post-json 'https://www.exploretock.com/api/graphql/PatronReservationHistory?opname=PatronReservationHistory' \ @body.json -p tock \ | jq -r '.data.purchases[] | "\(.ticketDateTime)\t\(.business.name)\t\(.ticketCount)ppl\t\(.ticketType.name)"' ``` If files are necessary: 1. Set `umask 077` before creating files containing authenticated data. 2. Create a private temporary directory using `mktemp -d`. 3. Store both request and response files inside that directory. 4. Register a shell trap to remove the directory on normal exit and interruption. 5. Avoid fixed filenames in shared temporary directories. 6. Use file-creation mechanisms that reject existing files and symbolic links. 7. Document that reservation responses contain PII and must not be retained, logged, committed, or shared unnecessarily. 8. Minimize the GraphQL selection set when the caller does not need customer names, email addresses, or patron identifiers. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The reservation-history request returns sensitive personal and transactional data for the signed-in user, including names, emails, reservation details, and cancellation status, yet the documentation presents it as a routine query without a prominent warning about privacy, authorization, or secure handling. In a shell/script context, these responses are likely to be saved to temporary files and processed with jq, increasing the risk of unintended exposure of PII through logs, shared terminals, or insecure file handling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This section documents how to derive the signed-in account holder’s identity from reservation history, including full name and email address, without any explicit privacy warning, consent boundary, or data-minimization guidance. Because the skill is designed to operate through a signed-in browser tab, it normalizes access to personal data and makes inadvertent collection or disclosure of PII more likely in scripts, logs, or downstream tooling.

Static analysis

No suspicious patterns detected.