Shanghai Library Seat Booking

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:42 AM UTC
• Version: 0.1.9

Overview

This skill is a disclosed Shanghai Library seat reservation helper that uses local auth profiles to list, book, and cancel reservations at the user's direction.

Install only if you are comfortable letting the skill store Shanghai Library auth tokens locally and use them to view, create, and cancel seat reservations. Keep the profile files private and review cancel commands carefully because they modify existing reservations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (66)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This duplicate mismatch finding highlights that cancellation functionality exists despite not being disclosed in the high-level description. Undisclosed state-changing operations are particularly relevant in agent settings because a user or platform may treat the skill as read/booking-only while it can also destroy existing reservations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This duplicate mismatch finding highlights that cancellation functionality exists despite not being disclosed in the high-level description. Undisclosed state-changing operations are particularly relevant in agent settings because a user or platform may treat the skill as read/booking-only while it can also destroy existing reservations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.

md

6. 不要求事先手动登录或手动保存认证文件；当使用 profile 文件时，`book_seat.js` 会在认证缺失或失效时自动拉起登录流程

Static analysis

No suspicious patterns detected.