Golf Tee Times

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:14 PM UTC
• Version: 1.0.0

Overview

This tee-time skill includes account login, stored credential use, saved payment selection, reward redemption, and reservation submission beyond ordinary search behavior.

Review this carefully before installing. It is acceptable as a GolfNow search helper only if you remove or tightly gate the booking flow. Do not allow it to access stored GolfNow credentials, saved cards, rewards, loyalty points, or Telegram screenshot sending unless each step is explicitly user-approved and scoped to the current user's account and transaction.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:180
• Finding: Over-Privileged Credential Retrieval and Saved Payment Instrument Use<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 180-196 **Vulnerability Type**: Excessive credential and financial-account privileges **Risk Level**: High ### Complete Vulnerable Snippet ```markdown ### Steps 1. **Navigate** to `https://www.golfnow.com/tee-times/facility/{facilityId}/tee-time/{teeTimeId}` 2. **Select golfer count** — click radio button, dispatch `change` event, verify green fees total updates 3. **Click "Continue to Book"** (`.btnBook`) — redirects to login if not authenticated 4. **Login** — GolfID iframe (`my.golfid.io`): use `frame=[src*=golfid]` to access email/password fields - Creds: `scripts/vault.sh get golfnow` 5. **Checkout page** (URL: `.../checkout/players/{count}`): - **Apply rewards**: Click `#applyRewardsBtn` → checkboxes by code ID (e.g. `#MEMBERSAVE`) - Note: Rewards marked "Cannot Be Combined" won't stack on Hot Deals - **Apply GolfPass Points**: Click `#btn-apply-loyalty-points` (these DO work on Hot Deals) - **Decline Tee Time Protection**: Click `input[name=rdlTeeTimeProtection][value=false]` - **Decline charity roundup**: Click "No Thanks" if desired - **Payment**: Pre-filled from saved cards (default: AMEX 1004) 6. **📸 SCREENSHOT & SEND TO USER** — Send checkout screenshot via Telegram before proceeding 7. **Wait for approval** 8. **Accept terms**: Check `#agree-terms-top` 9. **Click reservation**: `#reservation-button-top` ``` ### Technical Analysis The Skill is principally declared as a tee-time search and comparison tool, but its instructions extend its authority to retrieving credentials from a local vault, authenticating to a personal GolfNow account, consuming account rewards, selecting a saved payment instrument, accepting contractual terms, and initiating a financial transaction. The command `scripts/vault.sh get golfnow` grants the agent access to reusable account credentials. This substantially exceeds the privileges needed to query the public tee-time API. The ...[truncated 2237 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Separate public tee-time search from authenticated booking into distinct capabilities. 2. Remove `scripts/vault.sh get golfnow` from the Skill instructions. Use a platform-managed authentication broker that does not expose reusable credentials to the agent. 3. Require explicit, operation-specific user authorization before authentication, reward redemption, payment-method selection, or checkout navigation. 4. Scope credentials to a single user and a single transaction. Prefer short-lived OAuth or delegated session tokens over passwords. 5. Remove the hardcoded `AMEX 1004` preference and all other personalized defaults from the distributable Skill. 6. Display available payment methods using masked identifiers and require the user to select one for each transaction. 7. Require separate confirmation for: - Applying rewards or loyalty points - Selecting a payment method - Accepting contractual terms - Submitting the reservation 8. Bind approval to a structured transaction summary containing the facility, date, time, player count, total charge, rewards consumed, cancellation terms, and masked payment method. 9. Restrict vault policy so this Skill cannot access credentials during search-only operations. 10. Record auditable consent events without storing credentials, authentication fields, or payment information in logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:178
• Finding: Unredacted Checkout and Confirmation Screenshots Sent Through Telegram<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 178-203 **Vulnerability Type**: Sensitive information disclosure through screenshots **Risk Level**: Medium ### Complete Vulnerable Snippet ```markdown ### ⚠️ CRITICAL: Always send a screenshot of the final checkout page to the user BEFORE clicking "Make Your Reservation". Wait for explicit approval. ### Steps ... 5. **Checkout page** (URL: `.../checkout/players/{count}`): - **Apply rewards**: Click `#applyRewardsBtn` → checkboxes by code ID (e.g. `#MEMBERSAVE`) - **Apply GolfPass Points**: Click `#btn-apply-loyalty-points` (these DO work on Hot Deals) - **Decline Tee Time Protection**: Click `input[name=rdlTeeTimeProtection][value=false]` - **Decline charity roundup**: Click "No Thanks" if desired - **Payment**: Pre-filled from saved cards (default: AMEX 1004) 6. **📸 SCREENSHOT & SEND TO USER** — Send checkout screenshot via Telegram before proceeding 7. **Wait for approval** ... 10. **Confirmation**: Remove Truist ad overlay (`[class*=rokt], [class*=bold]`), screenshot confirmation page ### the user's Booking Preferences - Always apply points/rewards to minimize cost - Decline Tee Time Protection (save $3-4) - Default payment: AMEX ending 1004 - Send confirmation screenshot after booking ``` ### Technical Analysis The instructions mandate transmitting checkout and confirmation screenshots through Telegram without requiring redaction, content inspection, recipient verification, or user consent to transmit personal data through that channel. Checkout and confirmation pages commonly contain sensitive information such as customer names, email addresses, billing details, masked card identifiers, loyalty balances, reservation identifiers, location and schedule data, and transaction totals. Screenshots capture all visible page content indiscriminately and may also include browser chrome, account details, notifications, or unrelated information. Sending the image through Te ...[truncated 2017 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace screenshots with a locally generated, structured transaction summary containing only the information needed for approval. 2. If screenshots remain necessary, crop them to the price, tee time, cancellation policy, and final action area. 3. Automatically redact: - Names and email addresses - Billing addresses - Account identifiers - Payment details, including masked card suffixes - Reward and loyalty balances - Reservation references and barcodes - Session tokens or sensitive URL parameters 4. Require explicit user consent before transmitting checkout information through Telegram. 5. Verify the destination chat and recipient identity before sending any transaction-related content. 6. Disable Telegram previews where possible and define a short retention or automatic-deletion period. 7. Never include authentication screens, password fields, browser developer tools, cookies, or session information in captures. 8. Send confirmation as a minimal text summary unless the user explicitly requests an image. 9. Add a pre-transmission inspection step that blocks sending when sensitive fields remain visible. 10. Document Telegram as a third-party data recipient and ensure the data-handling policy reflects its retention and access characteristics. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The manifest promises search/comparison behavior, but the documented workflow relies on predefined or manually discovered GolfNow facility IDs and includes operational behavior beyond simple search. This mismatch can mislead orchestration systems and users, causing the skill to be invoked in contexts where it will either overreach or fail unpredictably.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: A skill presented as a tee-time finder includes a complete browser booking workflow culminating in reservation submission. That is a significant scope escalation from search to transactional account activity, increasing the risk of unauthorized purchases or account actions under the guise of a harmless informational skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill directs retrieval and use of stored GolfNow credentials from a vault for login, even though its declared purpose is search/deals discovery. Accessing stored credentials without strong scope justification expands the blast radius from information retrieval to account compromise or misuse if the skill is invoked unexpectedly or abused.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill instructs use of saved payment methods, acceptance of terms, and final reservation submission, all of which are transactional actions outside the justified scope of a search/comparison skill. This can directly lead to unauthorized charges or bookings if the skill is triggered accidentally or manipulated by a prompt.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs use of shell-capable tooling (`curl`, `python3`, helper scripts, and credential retrieval via `vault.sh`) but does not declare any explicit tool scope or permissions boundary. This creates a capability-governance gap where an agent may invoke shell actions beyond what users expect from a tee-time search skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation language is broad enough to match general golf-related conversations, which increases the chance the skill will be invoked outside narrowly intended scenarios. In this case that is dangerous because the same skill also contains credentialed and transactional instructions, so over-triggering can expose users to unintended account or purchase actions.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The 'When to Use' section lacks clear scope boundaries and negative triggers, encouraging invocation for broad booking-related intents. Because the skill contains hidden escalation into login and checkout behavior, vague trigger conditions materially increase the risk of unintended sensitive actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell the agent to use stored credentials without prominently warning the user that account secrets will be accessed. That undermines informed consent and can surprise users who believed they were only requesting public tee-time information.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

})

    try:
        r = subprocess.run([
            'curl', '-s', '-X', 'POST',
            'https://www.golfnow.com/api/tee-times/tee-time-results',
            '-H', 'Content-Type: application/json',

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The file specifies a 'Telegram Output Format' and later instructs sending screenshots via Telegram as if that channel is required. This can violate channel or locale flexibility expectations when the user has not opted into Telegram as the communication medium.

Static analysis

No suspicious patterns detected.