Golf Tee Times

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:14 PM UTC
• Version: 1.0.0

Overview

This tee-time skill includes account login, stored credential use, saved payment selection, reward redemption, and reservation submission beyond ordinary search behavior.

Review this carefully before installing. It is acceptable as a GolfNow search helper only if you remove or tightly gate the booking flow. Do not allow it to access stored GolfNow credentials, saved cards, rewards, loyalty points, or Telegram screenshot sending unless each step is explicitly user-approved and scoped to the current user's account and transaction.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:180

Finding

Over-Privileged Credential Retrieval and Saved Payment Instrument Use

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:178

Finding

Unredacted Checkout and Confirmation Screenshots Sent Through Telegram

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The manifest promises search/comparison behavior, but the documented workflow relies on predefined or manually discovered GolfNow facility IDs and includes operational behavior beyond simple search. This mismatch can mislead orchestration systems and users, causing the skill to be invoked in contexts where it will either overreach or fail unpredictably.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A skill presented as a tee-time finder includes a complete browser booking workflow culminating in reservation submission. That is a significant scope escalation from search to transactional account activity, increasing the risk of unauthorized purchases or account actions under the guise of a harmless informational skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directs retrieval and use of stored GolfNow credentials from a vault for login, even though its declared purpose is search/deals discovery. Accessing stored credentials without strong scope justification expands the blast radius from information retrieval to account compromise or misuse if the skill is invoked unexpectedly or abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs use of saved payment methods, acceptance of terms, and final reservation submission, all of which are transactional actions outside the justified scope of a search/comparison skill. This can directly lead to unauthorized charges or bookings if the skill is triggered accidentally or manipulated by a prompt.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly instructs use of shell-capable tooling (curl, python3, helper scripts, and credential retrieval via vault.sh) but does not declare any explicit tool scope or permissions boundary. This creates a capability-governance gap where an agent may invoke shell actions beyond what users expect from a tee-time search skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation language is broad enough to match general golf-related conversations, which increases the chance the skill will be invoked outside narrowly intended scenarios. In this case that is dangerous because the same skill also contains credentialed and transactional instructions, so over-triggering can expose users to unintended account or purchase actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The 'When to Use' section lacks clear scope boundaries and negative triggers, encouraging invocation for broad booking-related intents. Because the skill contains hidden escalation into login and checkout behavior, vague trigger conditions materially increase the risk of unintended sensitive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions tell the agent to use stored credentials without prominently warning the user that account secrets will be accessed. That undermines informed consent and can surprise users who believed they were only requesting public tee-time information.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · golfnow-search.py (reported line 59)May include surrounding context.

python

})

    try:
        r = subprocess.run([
            'curl', '-s', '-X', 'POST',
            'https://www.golfnow.com/api/tee-times/tee-time-results',
            '-H', 'Content-Type: application/json',

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file specifies a 'Telegram Output Format' and later instructs sending screenshots via Telegram as if that channel is required. This can violate channel or locale flexibility expectations when the user has not opted into Telegram as the communication medium.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.