百度理发店预约

• Outcome: Review
• Latest audit: May 29, 2026 · 9:28 PM UTC
• Version: 1.0.0

Overview

This salon booking skill works as described, but it sends phone and appointment details to an under-disclosed HTTP service and stores personal details locally.

Review before installing. Only use this skill if you trust the goldsalon999.fun backend with your phone number, name, and appointment details; avoid using it on untrusted networks because it uses HTTP, and delete or edit the baidu-hair-salon entry in ~/.openclaw/openclaw.json if you do not want your details retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill directs execution of Python tooling that can read and write local files and make network requests, yet the skill declares no permissions. That creates a transparency and trust problem: users and the host system are not clearly informed that the skill can persist personal data locally and contact remote services during booking.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a Baidu hair salon booking skill, but the described behavior includes persistent storage of personal data and use of a third-party domain not clearly identified as an official Baidu service. This mismatch can mislead users into trusting the skill more than they otherwise would, increasing the likelihood they disclose phone numbers and names to an unexpected backend.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill reads and writes persistent user preferences, including phone number, person name, shop, staff, and service data, to ~/.openclaw/openclaw.json. While some state retention can support booking convenience, this goes beyond a transient booking operation and stores personal data locally without clear consent, retention limits, or access controls.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The standalone pref-get and pref-set commands allow inspection and modification of persisted personal preferences outside the stated salon-booking intents. This expands the skill's data-management surface and enables local retrieval or tampering with personal data unrelated to immediate booking actions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs collection and persistent storage of the user's phone number and name in a local configuration file, but does not require a clear upfront privacy notice or explicit consent for retention. Because this is personally identifiable information and the skill also involves local file writes and remote booking actions, silent persistence materially increases privacy risk if the device, account, or skill environment is shared or compromised.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code saves phone and name preferences to a local config file silently, with no user-facing warning, consent, or privacy notice. Persisting personally identifiable information in plaintext increases the risk of local disclosure to other processes, users, backups, or support tooling.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill sends booking data, including phone number and appointment details, to a remote server over plain HTTP rather than HTTPS. This allows network attackers or intermediaries to intercept or modify sensitive booking requests and responses, which is especially dangerous because the endpoint appears to be an untrusted nonofficial domain.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.