Opentable Booking

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:24 AM UTC
• Version: 1.0.1

Overview

The skill is purpose-built for OpenTable booking, but it can automatically accept legal terms and expose booking form/payment-adjacent details without enough user control.

Review this skill carefully before installing. It is not malicious from the inspected artifacts, but it can act inside your logged-in OpenTable account, complete reservations using a saved card, accept terms automatically, and surface personal or payment-adjacent details to the agent. Use it only if you are comfortable supervising bookings and consent steps closely.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:157

Finding

Automatic Acceptance of Legal Terms Uses an Overbroad Checkbox Match

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 157–170
Vulnerability Type: Unsafe automated consent and ambiguous element selection
Risk Level: Medium

Vulnerable Code

javascript

(() => {
  const checkboxes = [...document.querySelectorAll('input[type="checkbox"]')];
  const terms = checkboxes.find(cb => {
    const label = cb.closest('label') || document.querySelector('label[for="' + cb.id + '"]');
    return label && /terms|conditions|policy|agree/i.test(label.textContent);
  });
  if (terms && !terms.checked) {
    terms.click();
    return 'checked terms';
  }
  if (terms && terms.checked) return 'already checked';
  return 'not found';
})()

Technical Analysis

The skill automatically checks a legally significant checkbox without requiring the agent to display the exact consent text or obtain explicit user approval. Selection is based on the first checkbox whose label contains any broad keyword such as policy or agree.

This logic does not establish that the selected control is the required reservation-terms checkbox. A page containing multiple matching controls could cause the code to select a privacy preference, marketing consent, cancellation-policy acknowledgment, or another unrelated agreement. The later snapshot verifies only that a checkbox was checked, not that the intended agreement was selected.

The same vulnerable pattern is duplicated in browser-snippets.md, lines 47–58.

Attack Path

1. The authenticated browser reaches an OpenTable checkout page.
2. The legitimate page, third-party page content, or injected content introduces a checkbox before the intended terms checkbox.
3. Its label contains one of the broad matching words, such as “policy,” “agree,” or “accept.”
4. The snippet uses Array.find() and selects the first matching checkbox.
5. The code invokes .click() and records consent without showing the exact label to the user.
6. The agent proceeds to submit the reservation.

Impact

...[truncated 497 chars]

Remediation

View remediation

Remediation Suggestions

• Display the complete checkbox label and relevant linked terms to the user before changing its state.
• Require explicit user confirmation before accepting legal or contractual terms.
• Replace broad keyword matching with a unique, verified selector or exact normalized label expected for the current OpenTable flow.
• Restrict matching to visible, enabled, required controls located inside the verified reservation form.
• Abort if zero or multiple candidate checkboxes are found.
• After selection, report the exact label and verify that the intended control—not merely any checkbox—is checked.
• Apply the same correction to the duplicate snippet in browser-snippets.md, lines 47–58.

T09 · Insecure Skill Coding Practices

Warning

• Location: browser-snippets.md:87

Finding

Form Discovery Serializes All Visible Input Values

Content

View full analysis

Vulnerability Details

File Location: browser-snippets.md, lines 87–104
Vulnerability Type: Unnecessary sensitive-data exposure
Risk Level: Medium

Vulnerable Code

javascript

(() => {
  const els = [...document.querySelectorAll(
    'input, select, textarea, button, [role="button"], [role="listbox"], [role="combobox"]'
  )];
  return els.filter(el => el.offsetParent !== null).map(el => ({
    tag: el.tagName,
    type: el.type || '',
    name: el.name || '',
    id: el.id || '',
    placeholder: el.placeholder || '',
    ariaLabel: el.getAttribute('aria-label') || '',
    value: el.value || '',
    text: el.textContent?.trim().substring(0, 50) || '',
    rect: el.getBoundingClientRect().toJSON()
  }));
})()

Technical Analysis

The diagnostic helper enumerates every visible form control and returns each element's raw value. Discovering controls requires only structural metadata such as type, name, label, and visibility; returning values is unnecessary.

On an authenticated and autofilled booking page, the serialized output may include names, email addresses, phone numbers, special requests, promotional codes, or other same-origin form data. These values become browser-tool output and may consequently enter agent context, execution traces, or logs.

The snippet does not explicitly transmit data to an external server, and no network-exfiltration mechanism was found. Nevertheless, it expands sensitive-data exposure beyond what is required for field discovery. It also weakens the assurance in SKILL.md, line 220, that card details are never read: if a visible payment-related input contained a readable value, this generic routine would attempt to serialize it.

Attack Path

1. The user opens an authenticated OpenTable booking page containing autofilled personal information.
2. The accessibility tree is incomplete, prompting use of the form-discovery snippet.
3. The snippet selects every visible input, select, and textarea eleme ...[truncated 870 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the value: el.value || '' field from the discovery output.
• Return only the minimum metadata needed to identify controls, such as tag, type, name, ID, label, and visibility.
• Use an allowlist of expected booking fields instead of enumerating every form control.
• Explicitly exclude password, payment, token, hidden, and autocomplete-sensitive controls.
• If value inspection is essential for a specific field, require a separate narrowly scoped operation and redact the result by default.
• Avoid retaining personal values in tool logs or traces, and apply short retention and access controls where logging cannot be disabled.
• Add regression tests confirming that discovery output never contains raw form values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The confirmation-scraping snippet explicitly extracts cardLast4 from page text, even though the skill’s stated purpose is booking a table and confirming reservation details. Collecting payment-related data beyond what is necessary expands sensitive-data exposure and creates unnecessary risk of logging, downstream leakage, or misuse in an environment that already operates with a logged-in account and stored card.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown instructs extraction of booking confirmation data and payment-related details without any warning or controls around sensitive-data handling. In a browser automation skill that uses an authenticated session and card on file, this omission makes accidental collection, retention, or disclosure of sensitive user information more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.