ClawHub
Back to skill

Security audit

Book Wedding

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its wedding-booking purpose, but it can create external bookings using personal contact details without clear final user-confirmation guidance.

Install only if you are comfortable with the agent using Lokuli's external MCP service for wedding search and booking. Before any booking is made, require the agent to show the provider, service, time, price or fees if known, cancellation terms if known, and every personal detail that will be sent, then get your explicit confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:50
Finding

Booking Creation and Personal Data Disclosure Without Mandatory User Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–64
Vulnerability Type: other: Unconfirmed Transaction and Personal Data Disclosure
Risk Level: Medium

json
{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "john@example.com",
      "customerPhone": "+13105551234"
    }
  }
}

Technical Analysis

The Skill defines a state-changing create_booking operation that sends a customer's name, email address, and telephone number to the external MCP endpoint at https://lokuli.com/mcp/sse. However, its instructions do not require the Agent to obtain explicit user confirmation immediately before submission, present the final booking details, disclose the data recipient, or ensure that personal information was supplied for this specific transaction.

Consequently, an Agent following the Skill may interpret a broad request to find wedding services as authorization to complete a booking. The missing confirmation boundary also allows incorrect, inferred, stale, or contextually unrelated personal information to be transmitted.

Attack Path

  1. A user makes a broad wedding-service request that activates the Skill, such as asking to find wedding services nearby.
  2. The Agent searches for a provider and checks availability through the external MCP service.
  3. The Agent obtains customer contact details from the conversation or other available context, or incorrectly infers that previously supplied details may be reused.
  4. Because the Skill contains no mandatory final-confirmation requirement, the Agent invokes create_booking.
  5. The external service receives the customer's name, email address, and phone number and may create a booking that the user did not explicitly approve.

Imp

...[truncated 610 chars]

Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed user confirmation immediately before every create_booking call.
  • Present a final summary containing the provider, service, date, time, applicable price or fees, cancellation terms, destination domain, and every personal-data field that will be transmitted.
  • Treat search and availability requests as distinct from authorization to create a booking.
  • Prohibit the Agent from inferring customer contact details or reusing details from unrelated contexts without specific approval.
  • Collect and transmit only the minimum personal information required by the provider.
  • Validate provider and service identifiers against prior search results and verify the time slot immediately before submission.
  • Return the remote service's booking identifier and status to the user, and document cancellation and error-recovery procedures.
  • Avoid retries after ambiguous network failures unless booking status is checked first, preventing duplicate reservations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documents collection and transmission of customer name, email, and phone number to an external MCP service without any user-facing warning or consent guidance. Because this skill performs booking with personal contact data, the omission creates a meaningful privacy and compliance risk, especially if the agent sends user data to lokuli.com without making that external transfer explicit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger language is broad enough to activate on general wedding-related requests, not just explicit booking intent. That can cause unintended invocation of an external MCP-connected skill, increasing the chance of unnecessary data flow, user confusion, or actions being prepared in contexts where the user only wanted information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The manifest and prose describe a wedding-booking skill, but the documented tool example invokes a generic search operation with only query: "wedding" and no wedding-specific constraints or booking semantics. This is a mild intent/documentation divergence because the docs present the capability more generically than the stated purpose, which could mislead implementers about the skill's intended scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.