Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward tee-time search helper that sends golf search queries to a hosted service and does not show hidden persistence, booking, payment, or destructive behavior.
Install only if you are comfortable sending tee-time search details such as location, date, party size, and timezone to Pin Seeker. Do not treat results as reservations; the skill is designed to provide GolfNow links for the user to complete booking separately.
The skill invokes shell-based capabilities (curl, bundled search.sh) but does not declare any explicit tool scope or allowed-tools restrictions. This increases the risk that an agent runtime grants broader shell access than necessary, enabling unintended command execution paths beyond the intended HTTP search operation.
The manifest says to use the skill when asked about 'golf', 'weekend golf', or 'comparing courses', which are broad natural-language triggers rather than narrowly scoped invocation conditions. This can cause unintended activation for general golf discussion instead of specific tee-time lookup tasks.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Hermes:
hermes skills install https://pinseeker.xyz/skills/pin-seeker/SKILL.md
Production search: https://pinseeker.xyz/api/agent/search
The script sends the user’s natural-language query, and optionally their timezone, to a remote third-party service without any explicit disclosure beyond minimal CLI usage text. While this is expected for a search skill, it still creates a privacy risk because users may include sensitive location, schedule, or personal details in free-form queries that are transmitted off-host.
No suspicious patterns detected.