Security audit

Restaurant Booking - OpenTable

Security checks for vulnerabilities and agentic risk

Overview

This OpenTable booking skill is mostly coherent, but it can act in a logged-in account with a saved card while collecting unnecessary payment/form data and making consequential choices without clear user approval.

Install only if you are comfortable giving the agent control of an authenticated OpenTable session with a saved payment method. Before any reservation is submitted, require the agent to show the exact restaurant, date, time, party size, booking type, fees or cancellation terms, and consent text, and do not allow it to collect or report card details or broad form values.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: browser-snippets.md:89
Finding: Overbroad Collection of Visible Form Values
Content: View full analysis
{ const els = [...document.querySelectorAll( 'input, select, textarea, button, [role="button"], [role="listbox"], [role="combobox"]' )]; return els.filter(el => el.offsetParent !== null).map(el => ({ tag: el.tagName, type: el.type || '', name: el.name || '', id: el.id || '', placeholder: el.placeholder || '', ariaLabel: el.getAttribute('aria-label') || '', value: el.value || '', text: el.textContent?.trim().substring(0, 50) || '', rect: el.getBoundingClientRect().toJSON() })); })() ``` ### Technical Analysis The form-discovery helper queries every visible `input`, `select`, and `textarea` on the page and returns each element's current `value`. Control discovery only requires metadata such as element type, label, name, and position; collecting values violates data-minimization and least-privilege principles. The query does not exclude password fields, payment-related controls, authentication values, personal information, anti-CSRF values exposed in visible controls, or unrelated fields introduced by OpenTable or embedded content. Returned values can enter browser-tool output, agent context, or diagnostic logs. This behavior also weakens the privacy assurances in `SKILL.md`, which state that card details are never read or logged. ### Attack Path 1. The authenticated booking page contains a visible input or textarea holding sensitive or unrelated information. 2. The accessibility snapshot does not expose a required control. 3. The agent invokes the documented “Discover Form Fields” snippet. 4. The snippet reads the `value` of every visible matching element. 5. Sensitive values are serialized and returned through the browser tool, making them available to the agent and potentially to to ...[truncated 444 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:115
Finding: Booking Time May Be Changed Without Explicit User Approval
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: browser-snippets.md:47
Finding: Broad Checkbox Matching Can Accept Unintended Consent
Content: View full analysis
{ const cbs = [...document.querySelectorAll('input[type="checkbox"]')]; const terms = cbs.find(cb => { const label = cb.closest('label') || document.querySelector('label[for="' + cb.id + '"]'); return label && /terms|conditions|policy|agree|accept/i.test(label.textContent); }); if (terms && !terms.checked) { terms.click(); return 'checked terms'; } if (terms && terms.checked) return 'already checked'; return 'terms checkbox not found'; })() ``` ### Technical Analysis The snippet selects the first checkbox whose label contains any of several broad words, including `policy`, `agree`, and `accept`. These terms can appear in optional marketing consent, privacy preferences, newsletter enrollment, or other unrelated controls. The implementation does not verify that the checkbox is required, uniquely matched, associated with the reservation submission form, or specifically represents mandatory booking terms. It also does not reject pages containing multiple matching checkboxes. Calling `.click()` automatically grants consent through the user's authenticated session. ### Attack Path 1. The booking page contains multiple checkboxes, including an optional checkbox with a label such as “Accept marketing policy.” 2. The optional checkbox appears before the actual required booking-terms checkbox in document order. 3. The regular expression matches the optional checkbox. 4. `Array.find()` returns that first match. 5. The snippet clicks it automatically, recording consent the user did not explicitly provide. 6. The actual required checkbox may remain unchecked, or the booking may proceed with unintended optional consent. ### Impact Assessment The flaw does not provide operating-system access. It misuses t ...[truncated 304 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The confirmation-scraping snippet collects cardLast4 from page text even though the skill’s core function is booking a table, not handling or returning payment-card data. In a browser automation skill operating on a logged-in account with a card on file, this expands data access beyond necessity and can expose sensitive payment metadata to downstream logs, tool outputs, or other components.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown instructs scraping confirmation details that include the last four digits of a stored payment card without any warning, justification, or handling guidance for sensitive data. Because this skill is intended to run with an authenticated OpenTable session and saved card, normalizing this extraction increases the chance that payment-related data is unnecessarily collected, surfaced to operators, or retained in transcripts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.