T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:45
- Finding
- Booking Creation and Personal Data Disclosure Without an Explicit Confirmation Requirement## Vulnerability Details **File Location**: `SKILL.md`, lines 45–63 **Vulnerability Type**: Missing authorization safeguard for a consequential external action **Risk Level**: Medium ### Vulnerable Code ```markdown ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" } } } ``` ``` ### Technical Analysis The skill defines a `create_booking` operation that transmits a customer's name, email address, and telephone number to the external Lokuli MCP service and creates a real-world appointment. However, the skill contains no instruction requiring the agent to obtain explicit final approval immediately before invoking this consequential operation. Search and availability requests do not necessarily imply authorization to create a booking or disclose personal information. Without a confirmation boundary, an agent could interpret a general request to find carpet-cleaning services as permission to complete a booking. The instructions also do not require verification of the selected provider, service, appointment time, price, cancellation terms, or exact personal information before transmission. This is an insecure skill-design practice because authorization for discovery is not equivalent to authorization for transaction execution. The finding does not establish malicious behavior by the external service, and the reviewed file contains no evidence of arbitrary code execution, privilege escalation, persistence, or credential theft. ### Attack Path 1. A user asks the agent to find carpet-cleaning services or otherwise triggers the skill. 2. The agent calls `search` and obtains provider and service identifiers. 3. The agent ...[truncated 1205 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation immediately before every `create_booking` call. 2. Present a concise transaction summary containing: - Provider name and identifier. - Selected service. - Appointment date, time, and time zone. - Total price and applicable fees, when available. - Cancellation or refund terms, when available. - The destination service receiving the data. - Every personal-data field that will be transmitted. 3. Clearly distinguish authorization to search or check availability from authorization to create a booking. 4. Use only contact details directly supplied or explicitly approved by the user; never invent missing personal information. 5. Collect and transmit only fields necessary for the booking. 6. If material booking details change after confirmation, invalidate the prior approval and request confirmation again. 7. Return a booking receipt or confirmation identifier after a successful transaction and provide cancellation instructions where supported. 8. Handle uncertain or incomplete responses conservatively: do not retry a potentially successful booking blindly, because this could create duplicate appointments.