Booking Extranet Manager

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 1.1.0

Overview

This skill is for real Booking.com account automation, but it asks users to install unpinned external code that handles credentials, persistent sessions, guest messages, and live rate changes.

Review this before installing. Use only a pinned, audited commit of the external repository, lock and verify dependencies, protect the .env and .chrome-data files, and require explicit human approval with a preview before sending guest messages or changing rates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:50

Finding

Unpinned Remote Repository and Unverified Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill is designed to access and use Booking.com credentials from a local .env file and persist an authenticated browser session, which materially increases credential exposure and session theft risk on the host. Although this is part of intended functionality rather than overtly malicious behavior, it still constitutes sensitive credential handling with elevated impact because it grants access to a live partner extranet account and potentially 2FA-backed sessions.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- browser_automation: Uses Google Chrome via remote debugging (CDP on localhost:9222)
  - local_storage: Persists browser session in .chrome-data/ directory to avoid repeated login/2FA
  - network: Connects only to admin.booking.com and account.booking.com
  - filesystem: Reads .env for credentials, writes Excel files to ./downloads/
---

# Booking.com Extranet Manager

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables sending messages to Booking.com guests but does not explicitly warn that this action affects real external users and may be irreversible once sent. In an agent setting, omission of that warning increases the risk of accidental customer communication, reputational harm, and unauthorized or mistaken responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The rate update command is described as a routine operation without clearly stating that it changes live pricing data for an actual property. In an autonomous or semi-autonomous environment, missing this warning can lead to unintended price changes, revenue loss, booking disruption, or contractual/customer issues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.