Playtomic - Book courts using padel-tui

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:32 AM UTC
• Version: 1.0.0

Overview

This skill helps book or cancel padel courts through a CLI, with the sensitive actions disclosed and requiring user intent, though users should verify the third-party install source.

Before installing, confirm you trust the padel-tui source and prefer a pinned release with checksum or signature verification. Use interactive login only, do not share Playtomic credentials with the agent, and review booking or cancellation details before approving those commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/INSTALLATION.md:5
• Finding: Unverified Third-Party Installation and Execution Paths## Vulnerability Details **File Location**: `references/INSTALLATION.md`, lines 5–30 **Vulnerability Type**: Unverified third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Option 1: Homebrew (macOS/Linux) ```bash brew install philipp-eisen/tap/padel-tui padel-tui --version ``` ## Option 2: Prebuilt Binary 1. Download the archive from GitHub releases. 2. Extract and verify: ```bash tar -xzf padel-tui-<version>-<platform>.tar.gz chmod +x padel-tui ./padel-tui --version ``` Add binary to `PATH` to use `padel-tui` globally. ## Option 3: Run From Source ```bash bun install ./bin/padel-tui --version ``` ``` ### Technical Analysis The installation guide permits software installation from a personal Homebrew tap, execution of a downloaded release binary, and dependency installation from a source checkout. None of these paths requires verification of the retrieved artifact or source revision. The prebuilt-binary procedure describes running `--version` as verification, but this executes the binary rather than establishing its integrity or authenticity. No expected cryptographic checksum, digital signature, canonical release URL, or pinned version is provided before `chmod +x` and execution. The Homebrew command does not pin a formula revision or package version. The source installation similarly invokes `bun install` without requiring a verified repository, trusted commit, frozen lockfile, or restrictions on dependency lifecycle scripts. Consequently, the effective installed code can change after this skill has been reviewed. ### Attack Path 1. An attacker compromises the referenced Homebrew tap, release distribution channel, upstream dependency, or source checkout used by the operator. 2. The attacker publishes a modified formula, archive, binary, package version, or dependency lifecycle script. 3. Following the documented p ...[truncated 1317 chars]
• Remediation: ## Remediation Suggestions 1. Identify and link the canonical source repository and exact release page rather than referring generically to GitHub releases. 2. Pin a reviewed release version, Homebrew formula revision, or source commit instead of installing mutable latest content. 3. Publish SHA-256 or stronger checksums through a separately protected channel and require verification before extraction or execution. 4. Prefer signed release artifacts and document signature verification against a pinned maintainer public key. 5. For source installation, require a verified repository checkout at an approved commit and use a committed lockfile with a frozen or immutable installation mode. 6. Audit dependency lifecycle scripts and disable them during installation where compatible with the application. 7. Clarify that invoking `--version` only tests execution and is not an integrity check. 8. Avoid adding an unverified binary to `PATH`; install it only after authenticity and integrity verification. 9. Recommend running installation with ordinary user privileges and without unnecessary access to sensitive files or environment variables.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Confirm installation intent before running any install command.
- Ask: "Do you want me to install `padel-tui` now, or skip installation and use your current setup?"
- If installation is declined, continue with the existing binary/path.
- Do not ask the user for email or password.
- Ask the user to authenticate interactively with `<prefix> auth login`.
- Treat `book` and `match-cancel` as user-impacting operations and run only after explicit user intent.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.