Km Destine Skill

• Outcome: Review
• Latest audit: Aug 27, 2026 · 2:07 AM UTC
• Version: 0.0.1

Overview

This appears to be a real KTV booking skill, but it needs review because it can log in, create or cancel orders, run a local payment polling script, and leave booking details in temporary files.

Install only if you trust the @ktvme/km-bot CLI and are comfortable with the agent using your KTV account to create, monitor, and cancel bookings. Before using it, verify order details before any order or cancellation, do not provide OTP codes outside the intended login flow, and be aware that payment/order details may be written to local /tmp files until manually cleaned up.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to launch a background shell/Python process and then block on task output to poll payment status. That grants unnecessary local code-execution and process-control behavior to a booking workflow, expanding the attack surface and creating opportunities for abuse, denial of service, or execution of modified local scripts outside the declared business need.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill tells the agent to read payment results from predictable local temporary files under /tmp. For a KTV booking skill, local filesystem access is not necessary for core functionality and introduces risks such as tampering, symlink attacks, information leakage, or cross-task data exposure if other local processes can influence those files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script writes payment polling results, including order metadata such as guest_name, charge, usage times, and potentially full order_data, into /tmp using a predictable filename derived from order_id. On multi-user or shared systems, temporary directories are common disclosure targets, and predictable names can expose sensitive booking/payment data or enable tampering if file permissions and symlink safety are not tightly controlled.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger conditions are overly broad, including generic references to singing, gatherings, or social plans, which can cause the skill to activate in conversations that do not clearly request booking. Over-broad activation increases the chance of unnecessary login, account-context access, or payment-related flows being initiated without strong user intent, making the surrounding sensitive actions more dangerous.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill description advertises integrated login and order payment flows but does not clearly disclose that it may process authentication data, account state, order identifiers, and initiate payment-impacting actions. In a skill that can create orders and drive payment, weak disclosure and missing consent checkpoints heighten privacy and user-harm risks if the skill activates unexpectedly or proceeds too far automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.