Browser Booking Agent

Execute booking/search flows via browser automation with verification artifacts. Use for reservation forms, availability checks, and capture of proof (screen...

Security Scan

The skill's purpose (automated browser booking) is plausible but the instructions omit key operational details (what tooling runs the browser, how credentials/PII are handled), creating a mismatch that could lead to unexpected access to sensitive data or actions.

Purpose & Capability

The skill claims to perform browser automation (navigate sites, fill forms, take screenshots, capture confirmation IDs) but declares no required binaries, tools, or credentials. A real browser-automation task normally needs a browser/automation runtime (Playwright, Selenium, or platform browsing tool) and often credentials for logins. The lack of declared tooling or runtime assumptions is an incoherence: it is unclear how the agent should execute the described flows.

Instruction Scope

SKILL.md tells the agent to 'navigate and complete booking/search flow' and to 'capture verification' but is high-level and gives the agent broad discretion about what to enter and what to capture. Guardrails (no payment without explicit approval; stop on captcha/2FA) are helpful, but the instructions do not constrain collection or transmission of PII/credentials, do not specify where screenshots or confirmation artifacts are stored or sent, and do not limit which external endpoints the agent may communicate with when automating flows.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing will be written to disk by the skill itself. That minimizes supply-chain risk. However, the skill implicitly requires a browser automation capability which is not specified; verify whether the hosting platform provides that capability and which binaries/runtimes will actually run.

Credentials

The skill requests no environment variables or primary credential, yet the use case (logins, filling reservation forms, capturing confirmation IDs, handling screenshots) commonly involves sensitive data (usernames, passwords, payment info). The skill does not declare how such credentials would be supplied or protected, nor does it require ephemeral credentials or storage constraints—this lack of explicit handling is disproportionate to the sensitivity of the intended actions.

Persistence & Privilege

always is false and the skill is user-invocable only (normal defaults). The skill does not request persistent presence or to modify other skills or system-wide settings, so there is no elevated persistence privilege.

What to consider before installing

This skill's goal (automating bookings and capturing proof) is reasonable, but it omits crucial operational details. Before installing or invoking it: 1) Ask the developer what browser automation runtime will be used (Playwright, Selenium, built-in web tool) and whether that runtime runs on your device or the platform. 2) Confirm how the agent will receive and store any credentials or payment data (avoid giving long-lived secrets; prefer ephemeral tokens or manual entry at time of action). 3) Ask where screenshots and confirmation artifacts are saved and who can access them. 4) Ensure the agent will not auto-submit payments or transmit captured data to unknown endpoints. 5) If possible, run the skill in a constrained/test environment with non-production credentials first. If the developer cannot clarify the tooling and data-handling details, treat the skill as higher-risk and avoid providing real credentials or payment information.

Workflow

1. Confirm task scope and required fields.
2. Navigate and complete booking/search flow.
3. Capture verification: screenshot + confirmation ID/details.
4. Return concise status: completed / blocked / needs user input.

Guardrails

• Never submit payment without explicit user approval.
• If blocked by captcha/login/2FA, stop and request user action.
• Preserve evidence of critical steps.

References

• Read references/verification-checklist.md.