Security audit

用空位“雷达”替你抢旅游目的地的米其林/热门餐厅

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent restaurant-booking skill, but it gives the agent authority to monitor sites and submit reservations using personal contact details without consistently requiring a clear final confirmation.

Install only if you are comfortable with an agent checking reservation platforms and acting on your behalf. Require explicit confirmation before every booking submission, any use of verification codes, any card guarantee or deposit, and any sharing of contact details with a third-party platform or notification service; ask the agent to mask contact details and provide a stop-monitoring command.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation condition is overly broad because it triggers not only on explicit restaurant-booking requests but also on general travel-planning conversations involving restaurant reservations. This can cause the skill to activate when the user did not intend to start reservation monitoring or share contact details, increasing the risk of unnecessary collection of personal data and unintended autonomous actions.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: Forcing Chinese-only interaction without offering a language choice can cause users to misunderstand what data is being requested, what actions will be taken, and when consent is being given. In a skill that collects contact details and may autonomously initiate reservations, language mismatch increases the chance of invalid consent and user confusion about sensitive workflow steps.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples explicitly collect and then echo back a user's phone number and email address without any notice about privacy, storage, retention, sharing, or masking. In a reservation-monitoring skill, this normalizes unnecessary exposure of personal contact data in chat transcripts and can lead to accidental disclosure, over-collection, or unsafe downstream handling by agents and integrated services.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This example shows the agent submitting a reservation through a third-party platform immediately after receiving only a phone number, before obtaining explicit confirmation for that specific booking. Because restaurant reservations can trigger holds, cancellation penalties, or other commitments, demonstrating autonomous submission without a clear consent checkpoint creates a meaningful risk of unauthorized transactions or unwanted bookings.

Static analysis

No suspicious patterns detected.