Security audit

chucho — Book Direct

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently helps users find vacation rentals through Chucho, with disclosed remote search/quote tooling and explicit approval required before sending contact details.

Before installing, understand that searches and quote checks go to Chucho's remote MCP service, and contact details should only be sent after you review and approve an enquiry proposal. Do not put secrets into search fields.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description says the skill is for vacation-home searches 'in English or Spanish,' which imposes a language constraint in the skill's natural-language behavior. The file does not present this as a user choice or clearly justify it as a region-specific limitation, so it may violate language/locale policy guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.