other
Warning
- Location
- SKILL.md:50
- Finding
- Booking Creation and Personal Data Disclosure Without Mandatory User Confirmation## Vulnerability Details **File Location**: `SKILL.md`, lines 50–64 **Vulnerability Type**: `other: Unconfirmed Transaction and Personal Data Disclosure` **Risk Level**: Medium ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" } } } ``` ### Technical Analysis The Skill defines a state-changing `create_booking` operation that sends a customer's name, email address, and telephone number to the external MCP endpoint at `https://lokuli.com/mcp/sse`. However, its instructions do not require the Agent to obtain explicit user confirmation immediately before submission, present the final booking details, disclose the data recipient, or ensure that personal information was supplied for this specific transaction. Consequently, an Agent following the Skill may interpret a broad request to find wedding services as authorization to complete a booking. The missing confirmation boundary also allows incorrect, inferred, stale, or contextually unrelated personal information to be transmitted. ### Attack Path 1. A user makes a broad wedding-service request that activates the Skill, such as asking to find wedding services nearby. 2. The Agent searches for a provider and checks availability through the external MCP service. 3. The Agent obtains customer contact details from the conversation or other available context, or incorrectly infers that previously supplied details may be reused. 4. Because the Skill contains no mandatory final-confirmation requirement, the Agent invokes `create_booking`. 5. The external service receives the customer's name, email address, and phone number and may create a booking that the user did not explicitly approve. ### Imp ...[truncated 610 chars]
- Remediation
- ## Remediation Suggestions - Require explicit, informed user confirmation immediately before every `create_booking` call. - Present a final summary containing the provider, service, date, time, applicable price or fees, cancellation terms, destination domain, and every personal-data field that will be transmitted. - Treat search and availability requests as distinct from authorization to create a booking. - Prohibit the Agent from inferring customer contact details or reusing details from unrelated contexts without specific approval. - Collect and transmit only the minimum personal information required by the provider. - Validate provider and service identifiers against prior search results and verify the time slot immediately before submission. - Return the remote service's booking identifier and status to the user, and document cancellation and error-recovery procedures. - Avoid retries after ambiguous network failures unless booking status is checked first, preventing duplicate reservations.