Padel

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:34 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward guide for using a Playtomic booking CLI, with clear user approval steps and no hidden code, though its installation guidance relies on trusting upstream package sources.

Before installing, make sure padel-tui is the tool you intend to trust with Playtomic access, prefer an official and versioned source, avoid sudo, and treat the local session file as sensitive. Confirm booking and cancellation details before allowing commands that reserve or cancel a court.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/INSTALLATION.md:8
• Finding: Unverified Third-Party Installation Paths## Vulnerability Details **File Location**: `references/INSTALLATION.md`, lines 8–27 **Vulnerability Type**: Supply-chain exposure through unpinned and unverified dependencies **Risk Level**: Medium ### Vulnerable Code ```bash brew install philipp-eisen/tap/padel-tui padel-tui --version ``` ```text 1. Download the archive from GitHub releases. ``` ```bash tar -xzf padel-tui-<version>-<platform>.tar.gz chmod +x padel-tui ./padel-tui --version ``` ```bash bun install ./bin/padel-tui --version ``` ### Technical Analysis The installation guide offers three ways to obtain and execute third-party code, but none establishes an immutable and authenticated artifact: - The custom Homebrew tap is not pinned to an audited formula revision or package version. - The prebuilt-binary workflow does not specify an exact official repository or release URL and provides no checksum or signature verification. - The source workflow invokes `bun install` without requiring an audited lockfile or frozen dependency resolution. Merely running `--version` after installation does not establish integrity because the potentially substituted executable has already run. These weaknesses expose installation to compromised maintainers, release assets, repositories, package sources, or artifact substitution. ### Attack Path 1. An attacker compromises the custom tap, upstream release assets, source repository, or a resolved dependency. Alternatively, the user obtains an archive from an unofficial location because the guide does not identify the authoritative release URL. 2. The user explicitly approves installation and follows one of the documented workflows. 3. Homebrew installation logic, the downloaded executable, or Bun lifecycle/dependency code executes without prior cryptographic verification. 4. The attacker-controlled code runs with the installing user's privileges. 5. The code can ...[truncated 731 chars]
• Remediation: ## Remediation Suggestions 1. Specify the exact authoritative HTTPS repository and release URL rather than referring generically to “GitHub releases.” 2. Pin installation to an audited release version and, where practical, an immutable source commit. 3. Publish SHA-256 checksums or cryptographic signatures through an independently protected channel and require verification before extraction or execution. 4. Pin the Homebrew formula or release version and document the trust boundary of the custom tap. 5. Require a committed, reviewed Bun lockfile and use frozen lockfile installation so dependency resolution cannot change silently. 6. Disable or review dependency lifecycle scripts where supported and document any scripts that must run during installation. 7. Perform integrity verification before invoking the binary, including before `--version`. 8. Recommend installation under least privilege and explicitly warn users not to run these commands with `sudo` or an administrative account.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Confirm installation intent before running any install command.
- Ask: "Do you want me to install `padel-tui` now, or skip installation and use your current setup?"
- If installation is declined, continue with the existing binary/path.
- Do not ask the user for email or password.
- Ask the user to authenticate interactively with `<prefix> auth login`.
- Treat `book` and `match-cancel` as user-impacting operations and run only after explicit user intent.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.