Luma Event Manager

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:07 AM UTC
• Version: 2.1.1

Overview

This skill uses sensitive Luma cookies and can change RSVP or calendar data, but those capabilities are disclosed and fit the event-management purpose.

Install only if you are comfortable storing Luma session cookies in pass for this skill to read. Treat those cookies like passwords, use guest-list access only for events you are authorized to manage, and invoke RSVP or calendar-sync commands only when you intend to change your Luma or Google account data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This code is explicitly designed to scrape an authenticated event page, extract identifiers and CSRF material, and then attempt multiple forged RSVP POST requests against undocumented endpoints using the caller's cookies. Even if intended as automation, it performs account-state-changing actions on a third-party service through reverse-engineered request flows, which is dangerous because it can submit or alter RSVPs without clear user consent, break platform expectations, and enable misuse of session credentials.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file includes local secret retrieval by shelling out to `pass show luma/cookies` and then converts the returned secret into live session cookies for authenticated requests. This expands the scraper from passive web scraping into privileged credential access and subprocess execution, which is dangerous because any code path invoking it can silently use local secrets to access private account data and increases attack surface through shell execution.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The helper spawns a shell command (`pass show luma/api_key 2>/dev/null`) from a general utility file to determine configuration state. Even though the command string is constant and not obviously injectable, invoking a subprocess and shell for a simple check expands the attack surface, creates an unexpected runtime dependency on `pass`, and can execute an attacker-controlled binary if PATH or the environment is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The design explicitly uses browser-exported session cookies to access private Luma data such as guest lists, hosted events, and RSVPs, but it does not present clear user-facing warnings about privacy exposure, account compromise risk, ToS implications, or the sensitivity of session tokens. Because session cookies can act as bearer credentials, mishandling them could expose private attendee information or allow unauthorized account actions.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill advertises Google Calendar synchronization but does not clearly warn users that this feature can create or modify calendar entries in their Google account. Even if intended functionality is limited to adding events, lack of explicit disclosure can lead to unexpected account changes and unsafe consent boundaries.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly advertises access to hosted event guest lists and instructs users to extract and store live authentication cookies from their browser. Even though this is documentation rather than code, it normalizes handling session credentials in a manually copyable form and does not warn about the sensitivity of guest data or the risk of session-token compromise. In the context of a scraping-based skill with authenticated actions, this increases the chance of unauthorized account access or privacy violations if the cookies are mishandled, shared, or logged.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to extract and store live session cookies (`luma_session`, `luma_user_id`) that can grant access to private account data, but it does not clearly warn that these are sensitive credentials equivalent to being logged in. In this context, mishandling or exposing those cookies could let another party view private events, guest lists, or act on the user's behalf.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The skill supports adding events to a user's Google Calendar via the `gog` CLI, but it does not explicitly warn that this will perform write actions on an external account. While the action appears user-initiated, the lack of disclosure can lead to unintended modifications to calendars, especially if users assume the feature is read-only.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill exposes a guest-list viewing capability for hosted events but the manifest provides no user-facing privacy warning or indication that attendee information may be sensitive. This can lead to overbroad disclosure of names or other guest data if a user invokes the tool without understanding the sensitivity of the operation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The RSVP tool performs a state-changing action on the user's behalf, but its description does not warn that it will modify the user's event response. Without an explicit confirmation cue in the manifest, users may trigger unintended RSVPs or social/attendance commitments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The calendar tool writes to the user's Google Calendar, but the manifest does not clearly disclose that it modifies an external account. This can cause unintended calendar changes, privacy leakage through synced calendars, or clutter/overwrites if invoked without informed consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The configuration tool is intended to set an API key, but the manifest does not disclose that it will handle sensitive credentials. Users may be prompted to reveal secrets without adequate warning about secure handling, storage, or scope of use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directly invokes Google Calendar synchronization for a provided event slug without any explicit confirmation, dry-run, or user acknowledgement before making an external state-changing action. In an agent setting, ambiguous prompts, prompt injection from event content, or mistaken tool selection could cause unintended calendar modifications on the user's account.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The RSVP handler performs an authenticated account-affecting action immediately after receiving a slug and response, with no explicit confirmation or friction. In agent workflows, this creates a risk of unintended attendance changes from misunderstanding, malicious prompt content, or indirect tool invocation using the user's stored cookies.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function accepts raw session cookies and immediately uses them in authenticated requests to a third-party site, with no visible disclosure, consent gate, or safeguards around whose session is being used. Handling session cookies this way is risky because cookies are bearer credentials; misuse, logging, or accidental reuse can grant account access and let the skill act as the user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section performs multiple authenticated POST attempts with both cookies and extracted CSRF token to change RSVP status on the external service, but there is no built-in disclosure or confirmation that the action will modify the user's account state. The repeated endpoint/payload probing also increases risk by acting more like request forgery or endpoint abuse than a narrowly scoped documented integration.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: These authenticated scraping paths send session cookies to retrieve a user's private `/home` and `/home/manage` data without any user-facing disclosure or consent mechanism in the skill. In a skill context, silently transmitting authentication material to access private account pages creates privacy risk and can surprise users who may not realize their authenticated session is being used.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guest-list scraper uses session cookies to access `/slug/guests`, which may expose attendee names and related private event-participant data, yet there is no built-in warning, consent, or access check in the skill. Because this targets third-party personal data rather than only the current user's own profile, the privacy sensitivity and misuse potential are higher.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code executes a shell command to pull cookies from a password store without any user-facing disclosure, effectively turning locally stored secrets into active web-session credentials behind the scenes. Even though the command string is static, this behavior is risky because it obscures sensitive credential use and normalizes silent secret extraction inside a scraping utility.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This file defines tools for state-changing actions such as RSVP submission and adding events to a Google Calendar, but the interface metadata does not indicate any confirmation, warning, or explicit user-consent requirement before those actions are invoked. In an agent setting, that increases the risk of unintended external side effects from prompt injection, model misunderstanding, or ambiguous user requests, especially because these operations can modify third-party accounts or commitments.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: `geocodeLocation` sends user-provided location strings to Nominatim, an external third-party service, without any visible consent, warning, or privacy boundary at this layer. If callers pass home, workplace, or sensitive meeting locations, this leaks potentially private user data to an outside service and may violate privacy expectations or policy requirements.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "MIT",
  "dependencies": {
    "cheerio": "^1.2.0"
  },
  "devDependencies": {
    "@types/node": "^20.19.30",

• Confidence: 92% confidence
• Finding: "cheerio": "^1.2.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"cheerio": "^1.2.0"
  },
  "devDependencies": {
    "@types/node": "^20.19.30",
    "typescript": "^5.9.3"
  }
}

• Confidence: 80% confidence
• Finding: "@types/node": "^20.19.30"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "@types/node": "^20.19.30",
    "typescript": "^5.9.3"
  }
}

• Confidence: 80% confidence
• Finding: "typescript": "^5.9.3"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.