Security audit

Date Night

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent date-night booking assistant, but it includes overbroad private-message access, sensitive local storage, and future automated messaging jobs that need user review.

Install only if you are comfortable granting this skill access to booking sites, local contact/location preferences, messaging connectors, calendar tools, and limited SMS/iMessage data. Before use, remove broad SMS-history fallbacks, require approval at delivery time for all scheduled messages, pin dependencies, and protect stored config and browser session files with restrictive permissions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (7)

T06 · System Persistence

Error

Location: references/smart-features.md:54
Finding: Persistent scheduled jobs autonomously browse and send messages without contemporaneous approval<![CDATA[ ## Vulnerability Details **File Location**: `references/smart-features.md:54-76`, `references/smart-features.md:87-106`, `references/smart-features.md:217-236`, and `references/search-movies.md:108-121` **Vulnerability Type**: Cross-session scheduled-task persistence and autonomous messaging **Risk Level**: High ### Vulnerable Code ```json { "name": "reservation-monitor-{restaurant}-{date}", "enabled": true, "schedule": {"kind": "interval", "every": "30m"}, "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "Check if a {time-range} table for {N} opened up at {Restaurant} on {date}. Use playwright-cli to check https://www.opentable.com/r/{slug}?covers={N}&dateTime={date}T{time} — snapshot and look for available time slots. If found, USE THE MESSAGE TOOL to notify the user via {config.notify_channel}. Include available times. If no availability, do nothing. Disable this job after 24 hours or after booking.", "deliver": false, "thinking": "high" } } ``` ```json { "name": "dinner-reminder-{restaurant}-{date}", "enabled": true, "schedule": { "kind": "cron", "expr": "0 9 {day} {month} *", "tz": "{config.timezone or America/Chicago}" }, "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "Send a dinner reminder for tonight. Restaurant: {name}. Time: {time}. Party: {N}. Confirmation: {number}. Include: dress code, parking, drive time from {config.location}, weather forecast using wttr.in/{config.location}?format=3, and 'leave by' time. Ask if childcare is confirmed if {config.has_children}. USE THE MESSAGE TOOL to send via {config.notify_channel}.", "deliver": false } } ``` ```json { "name": "date-night-reminder", "enabled": true, "schedule": { "kind": "cron", "expr": "0 10 1-7 * 6", "tz": "{config.timezone or user's local TZ}", "comment": "First Saturday of each month at 10 AM" }, "sessionTarget": "isolated", "payload" ...[truncated 2760 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed opt-in before creating every scheduled job. - Display the exact schedule, expiry, data sources, destination channel, and future actions before activation. - Do not instruct scheduled turns to send directly. Generate a draft and require approval at delivery time. - Assign mandatory expiration times to all interval and recurring jobs. - Automatically delete one-time jobs after execution and availability monitors after booking or timeout. - Provide commands to list, pause, and delete all jobs created by the Skill. - Store job ownership metadata so unrelated skills cannot modify or reuse them. - Exclude confirmation numbers and other sensitive reservation details from notifications unless strictly necessary. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/sms-codes.md:42
Finding: Broad SMS-history fallbacks can disclose unrelated messages and authentication codes<![CDATA[ ## Vulnerability Details **File Location**: `references/sms-codes.md:25-31`, `references/sms-codes.md:42-49`, `references/sms-codes.md:59-62`, and `references/resy-flow.md:144-149` **Vulnerability Type**: Excessive SMS access and insufficient sender validation **Risk Level**: High ### Vulnerable Code ```bash # If using imsg (iMessage CLI) # After triggering an OpenTable verification, find the chat: imsg chats --limit 20 --json 2>/dev/null | jq -r 'select(.name | test("22395|opentable";"i")) | "\(.id) \(.name)"' 2>/dev/null || true # Or search recent messages for the verification sender only: imsg history --limit 10 2>/dev/null | grep -i "opentable\|22395\|verification code" || true ``` ```bash OT_CHAT=$(cat ~/.openclaw/skills/date-night/config.json | jq -r '.opentable_sms_chat_id // "unknown"') # Get latest code imsg history --chat-id ${OT_CHAT} --limit 1 2>/dev/null | grep -oE '[0-9]{6}' || true # If chat ID unknown, broad search: imsg history --limit 10 2>/dev/null | grep -oE '[0-9]{6}' | head -1 || true ``` ```bash # After triggering Resy SMS: imsg history --limit 10 2>/dev/null | grep -i "resy\|verification\|code" || true # Note the chat ID and update config similarly to OpenTable above ``` ### Technical Analysis The sender-specific `--chat-id` query is appropriately scoped, but the fallback invokes `imsg history --limit 10` without a chat identifier. That command reads the general recent-message stream before applying text filtering. The six-digit fallback is particularly unsafe because it accepts the first matching numeric sequence regardless of sender, message purpose, or timestamp. This contradicts the Skill metadata and `SKILL.md`, which declare that only the last one or two messages from known booking-service senders are read and that broad scans are not performed. ### Attack Path 1. A booking flow triggers SMS verification. 2. No valid OpenTable or Resy chat ID is stored in the configuration. 3. The Skill invokes the unrestricted ...[truncated 724 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove every fallback that calls `imsg history` without a verified `--chat-id`. - Require the user to select or confirm the sender chat during initial setup. - Verify the sender identifier, service name, message timestamp, and expected code length before extraction. - Restrict retrieval to messages received after the active verification request. - If sender verification fails, ask the user to enter the code manually rather than scanning the inbox. - Do not print complete message bodies; extract only the validated code within the SMS connector. - Store separate verified chat IDs for OpenTable and Resy. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/resy-flow.md:106
Finding: Sensitive PII and reusable browser authentication state are saved without restrictive permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:182-206` and `references/resy-flow.md:106-108` **Vulnerability Type**: Insecure plaintext storage of PII and session cookies **Risk Level**: High ### Vulnerable Code ```bash mkdir -p ~/.openclaw/skills/date-night cat > ~/.openclaw/skills/date-night/config.json << 'EOF' { "name": "{name}", "first_name": "{first_name}", "last_name": "{last_name}", "user_email": "{email}", "user_phone": "{phone_digits}", "partner": "{partner_or_null}", "notify_channel": "{channel}", "dietary": ["{pref1}", "{pref2}"], "has_children": {true|false}, "children_count": {N}, "children_ages": "{ages_or_null}", "location": "{City, ST}", "zip": "{zip}", "preferred_theater": "{theater_or_null}", "babysitter_rate": {rate}, "calendar_tool": "{tool}", "onboarded_at": "{ISO_TIMESTAMP}" } EOF ``` ```bash mkdir -p ~/.openclaw/skills/date-night/state playwright-cli -s=resy state-save ~/.openclaw/skills/date-night/state/resy-auth.json ``` ### Technical Analysis The commands rely on the process's ambient `umask` and do not enforce access modes on either the data directory or the files. The configuration contains names, phone numbers, email addresses, family information, and location. The Resy state file can contain reusable session cookies and other browser storage representing an authenticated session. Plaintext storage is disclosed, but the implementation does not apply standard local secret protections such as a `0700` directory and `0600` files. Consent is also described in `SKILL.md`, but the shown Resy flow saves state directly after login without an explicit consent step in that workflow. ### Attack Path 1. The user completes onboarding or logs into Resy. 2. The Skill creates the destination directories using default permissions. 3. It writes PII to `config.json` and browser authentication material to `resy-auth.json`. 4. If the environment has a permissive `umask`, another local account o ...[truncated 490 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Set `umask 077` before creating or modifying sensitive files. - Create the root and state directories with mode `0700`, for example `install -d -m 700`. - Create configuration and state files with mode `0600` and verify permissions after every replacement. - Ask for explicit consent immediately before persisting browser state. - Prefer platform credential storage or encryption at rest for reusable authentication material. - Minimize cookie lifetime and save only the state required for Resy. - Clear expired state automatically and provide a visible command to revoke all saved sessions. - Avoid storing optional family information unless the associated feature is enabled. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/smart-features.md:193
Finding: User-controlled values are interpolated directly into executable Python source<![CDATA[ ## Vulnerability Details **File Location**: `references/smart-features.md:193-209` **Vulnerability Type**: Python and shell injection **Risk Level**: High ### Vulnerable Code ```bash python3 -c " import json, os path = os.path.expanduser('~/.openclaw/skills/date-night/history.jsonl') lines = open(path).readlines() if os.path.exists(path) else [] out = [] for line in lines: r = json.loads(line.strip()) if r.get('restaurant') == '{Restaurant}' and r.get('date') == '{YYYY-MM-DD}': r['total_cost'] = {actual} r['rating'] = {rating} r['would_return'] = {true|false} r['notes'] = '{notes}' out.append(json.dumps(r)) open(path,'w').write('\n'.join(out)+'\n') print('Updated.') " 2>/dev/null || true ``` ### Technical Analysis Template values such as `{Restaurant}` and `{notes}` are inserted into quoted Python literals, while `{actual}`, `{rating}`, and `{true|false}` are inserted as raw Python expressions. These values are neither encoded nor passed as data. A quote, newline, command substitution sequence, or crafted Python expression can alter the generated program. The outer program is also enclosed in a shell double-quoted argument. Consequently, shell substitutions embedded in an interpolated value may execute before Python starts, while Python quote-breaking payloads can execute inside the interpreter. ### Attack Path 1. An attacker influences a restaurant name, note, rating, or actual-spend value processed by the Skill. 2. The value is substituted into the `python3 -c` template without escaping. 3. The crafted input terminates the intended shell or Python string. 4. The remaining payload is interpreted as shell syntax or Python code. 5. The injected code executes with the same local privileges as the agent. 6. The final `|| true` and redirected standard error may hide evidence of failed or partial exploitation. ### Impact Assessment Successful exploitation provides arbitrary code execution under the agent' ...[truncated 284 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Never construct Python source code from user-controlled values. - Place the update logic in a fixed script and pass values through `sys.argv`, standard input, or environment variables. - Serialize the complete update object with a trusted JSON encoder and parse it with `json.load`. - Strictly validate dates, monetary amounts, ratings, and booleans before use. - Treat restaurant names and notes exclusively as strings. - Write the history file atomically using a temporary file in the same protected directory. - Remove blanket error suppression so malformed input and update failures are visible. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/sms-codes.md:35
Finding: Predictable shared temporary file enables symlink and race-condition attacks<![CDATA[ ## Vulnerability Details **File Location**: `references/sms-codes.md:35-38` **Vulnerability Type**: Insecure temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash cat ~/.openclaw/skills/date-night/config.json | \ jq '. + {"opentable_sms_chat_id": {CHAT_ID}}' > /tmp/conf.json && \ mv /tmp/conf.json ~/.openclaw/skills/date-night/config.json ``` ### Technical Analysis The update operation uses the fixed, globally predictable path `/tmp/conf.json`. Shared temporary directories are normally writable by other local users. A local attacker can pre-create the path as a symbolic link or repeatedly replace it during the update. The temporary file also inherits ambient permissions, potentially making a copy of the sensitive configuration readable before it is moved. Moving a file from `/tmp` does not automatically correct its mode. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/conf.json`. 2. The attacker creates that path as a symbolic link to another file writable by the victim, or races the Skill's write and move operations. 3. The `jq` redirection follows the attacker-controlled path. 4. Data is written to an unintended target, or an attacker-controlled file is moved over the Skill configuration. 5. The attacker causes file corruption, unauthorized overwrite, or exposure of configuration data. ### Impact Assessment The flaw can corrupt the date-night configuration, disclose its PII, or overwrite another file writable by the agent account. The precise impact is constrained by the operating-system account's existing permissions, but no additional privilege is required beyond local access to the shared temporary directory. ]]>
Remediation: <![CDATA[ ## Remediation Suggestions - Use `mktemp` rather than a predictable filename. - Prefer creating the temporary file inside `~/.openclaw/skills/date-night/` so the final rename remains atomic. - Set `umask 077` and verify that the temporary and final files have mode `0600`. - Install a shell trap to remove the temporary file on failure or interruption. - Verify that the temporary path is a regular file owned by the current user before replacement. - Use `jq` with `--arg` or `--argjson` for the chat ID rather than direct template interpolation. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:37
Finding: Mutable latest-version package installation creates supply-chain execution risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37-46`, `SKILL.md:250-256`, and `SKILL.md:307-310` **Vulnerability Type**: Unpinned executable dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: playwright-cli kind: npm package: "@anthropic-ai/playwright-cli@latest" bins: ["playwright-cli"] label: "Install playwright-cli (npm)" - id: chromium kind: shell command: "npx playwright install chromium" label: "Install Chromium for playwright-cli" ``` ```bash # Verify playwright-cli is available export PATH="$HOME/.npm-global/bin:$PATH" playwright-cli --version || echo "INSTALL: npm install -g @playwright/cli@latest" ``` ### Technical Analysis The Skill installs and recommends packages through mutable `latest` tags. The effective code therefore depends on the registry state at installation time rather than the reviewed Skill contents. The `npx` command can also resolve and execute package tooling from the environment when no securely pinned local binary is available. There is no lockfile, exact version, integrity hash, or documented verification step. A compromised publisher account, malicious upstream release, registry compromise, or unexpected breaking update can introduce arbitrary code into the installation path. ### Attack Path 1. The required CLI is absent or a new installation is performed. 2. The installer resolves the mutable `latest` tag from the npm registry. 3. A compromised or unexpectedly modified package version is downloaded. 4. Package lifecycle code or the resolved CLI executes with the user's privileges. 5. Malicious dependency code accesses local files, connectors, browser state, or network resources. ### Impact Assessment Dependency code executes under the installing user's account and can access everything available to the Skill, including PII, browser sessions, message connectors, calendar tools, and local history. The risk affects new installations an ...[truncated 51 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Pin every npm package to an exact reviewed version. - Record and verify package integrity hashes. - Use a lockfile or an equivalent reproducible installation manifest. - Avoid implicit `npx` package resolution; invoke a verified local binary. - Disable unnecessary package lifecycle scripts during installation where compatible. - Document the expected registry and publisher identity. - Establish a controlled dependency-update process that includes review and security testing. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/pre-evening.md:90
Finding: User location and itinerary details are transmitted to additional third-party services without sufficiently specific disclosure<![CDATA[ ## Vulnerability Details **File Location**: `references/pre-evening.md:90-118`, `references/search-events.md:12-16`, and `references/search-restaurants.md:13-24` **Vulnerability Type**: Privacy-sensitive network disclosure **Risk Level**: Medium ### Vulnerable Code ```bash # Option A: Web search for drive time web_search "drive time from {config.location} to {restaurant address}" # Option B: Google Places for exact address, then estimate goplaces search "{restaurant name} {city}" --limit 1 --json 2>/dev/null | \ jq -r '.[0].formattedAddress' 2>/dev/null || true ``` ```bash # wttr.in — free, no API key curl -s "wttr.in/{config.location}?format=%l:+%t+%C+💧%p+💨%w" 2>/dev/null || true # Simpler format curl -s "wttr.in/{config.location}?format=3" 2>/dev/null || true ``` ```bash web_search "concerts near {config.location} {month} {year}" web_search "events near {config.zip} this weekend" web_search "comedy shows near {config.location} 2026" web_search "Broadway shows {config.location} 2026 season" ``` ### Technical Analysis The Skill sends configured location or ZIP data to search providers, Google Places, and `wttr.in`. Drive-time queries can combine the user's origin with a restaurant or venue destination, allowing a provider to infer itinerary information. Event and restaurant queries also disclose interests and approximate location. These transmissions are related to the declared weather, travel, restaurant, and event-search functionality. However, the Skill's privacy language focuses on transmitting name, email, and phone only to booking sites and does not clearly enumerate the additional recipients, transmitted location fields, retention implications, or combined itinerary data. ### Attack Path 1. The user supplies a city, ZIP code, or other location during onboarding. 2. A search, weather check, or post-booking intelligence workflow starts. 3. The Skill interpolates the stored location into a web-search, Places, or `wttr.in` request. 4. ...[truncated 570 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Clearly disclose each category of third-party recipient and the fields sent to it. - Obtain consent before transmitting stored location or itinerary information. - Use coarse city-level data instead of a precise address whenever possible. - Avoid placing origin, destination, and event timing in the same third-party query. - Make weather and drive-time lookups optional. - Prefer privacy-preserving or locally computed routing and weather sources where available. - Do not include names, confirmation numbers, phone numbers, email addresses, or partner details in search queries. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (52)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: | `~/.openclaw/skills/date-night/history.jsonl` | Date night log (restaurant, date, rating) | Low | | `~/.openclaw/skills/date-night/state/*.json` | Browser session cookies (Resy only, opt-in) | **Yes — auth tokens** | To purge all skill data: `rm -rf ~/.openclaw/skills/date-night/` ### Pre-Flight Check ```bash
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: | `~/.openclaw/skills/date-night/history.jsonl` | Date night log (restaurant, date, rating) | Low | | `~/.openclaw/skills/date-night/state/*.json` | Browser session cookies (Resy only, opt-in) | **Yes — auth tokens** | To purge all skill data: `rm -rf ~/.openclaw/skills/date-night/` ### Pre-Flight Check ```bash
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

Category: analysis-evasion
Content: | Restaurant search | [references/search-restaurants.md](references/search-restaurants.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Restaurant search | [references/search-restaurants.md](references/search-restaurants.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Movie booking | [references/movie-booking.md](references/movie-booking.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Movie booking | [references/movie-booking.md](references/movie-booking.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Event tickets | [references/event-tickets.md](references/event-tickets.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Event tickets | [references/event-tickets.md](references/event-tickets.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Finding movies | [references/search-movies.md](references/search-movies.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Finding movies | [references/search-movies.md](references/search-movies.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Finding events | [references/search-events.md](references/search-events.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Modify / Cancel | [references/modify-cancel.md](references/modify-cancel.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | SMS verification | [references/sms-codes.md](references/sms-codes.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | SMS verification | [references/sms-codes.md](references/sms-codes.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Pre-evening intel | [references/pre-evening.md](references/pre-evening.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | Smart features | [references/smart-features.md](references/smart-features.md) |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The flow explicitly instructs the agent to search the user's iMessage history for Resy verification codes, which exceeds the minimum access needed for booking and exposes unrelated private messages. In this date-night automation context, harvesting OTPs from a local message store creates a strong risk of unauthorized access to account-authentication data and broader privacy compromise.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill combines a long broad trigger list with open-ended natural-language examples, making invocation boundaries unclear. In a high-capability skill that performs browser automation, uses stored personal data, and may query messages or email, ambiguous activation materially raises the risk of unintended actions or data access.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes broad everyday phrases like `date ideas`, `events near me`, and `what's playing`, which can cause the skill to activate in contexts where the user did not intend browser automation, ticket workflows, or access to stored preferences. Because this skill can read local PII, fetch SMS verification codes, and drive booking actions, accidental activation increases the chance of unintended sensitive operations.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.