Security audit
Security checks for vulnerabilities and agentic risk
This Southwest seat-monitoring skill appears purpose-built and not malicious, but it asks users to run against a persistent logged-in browser profile and even suggests saved credentials without enough scoping or retention guidance.
Install only if you are comfortable giving the monitor access to a logged-in Southwest browser session. Use a dedicated Chrome profile for Southwest only, avoid storing the Southwest password unless you explicitly accept that risk, do not expose the CDP port beyond localhost, and review or disable any optional systemd persistence before use.
The skill describes use of environment variables and operational state but does not declare any explicit tool scope or permission boundaries. In practice, that creates an under-specified capability surface where an agent may access environment-backed secrets or local state without clear least-privilege constraints, which is a real security weakness even if not overtly malicious.
The documentation explicitly recommends storing Southwest login credentials in the browser password manager as a self-heal aid. That expands the skill from read-only seat monitoring into credential persistence and handling, increasing the risk of credential exposure through profile theft, local compromise, unintended autofill, or reuse of the persistent browser profile.
The skill instructs persistent storage of login credentials without a clear warning, consent step, or retention policy. In the context of a monitoring agent using a persistent headed browser profile, this is more dangerous because the profile is intended to remain active over time and possibly across reboots, increasing the exposure window for stored secrets.
The manifest says the skill watches for a window, aisle, or exit seat becoming available, but the implementation filters only for window seats and alerts only on r.openWindows. There is no code that identifies aisle seats or exit-row seats, so the actual behavior is narrower than the declared capability.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"private": true,
"type": "module",
"description": "Southwest seat monitor - reference implementation",
"dependencies": { "patchright": "^1.64.1" }
}
The documentation claims the script is 'READ-ONLY' and 'Never submits a seat change,' yet the automation actively clicks a segment-selection button in the seat-flow UI. While this may not finalize a seat change, the comment presents the behavior as purely non-interactive when the code does perform UI actions.
The code hard-codes toLocaleString('en-US', ...), which imposes a specific language/locale choice in the skill's behavior. The file does not offer a locale choice or explain why US English is required, so this is a natural-language locale policy concern.
No suspicious patterns detected.