Security audit

Food Calendar Order

Security checks across malware telemetry and agentic risk

Overview

This skill can place real food-delivery orders using saved browser accounts, but its primary instructions disclose that and require explicit confirmation before purchase.

Install only if you are comfortable letting an agent operate logged-in food delivery sites through your Chrome profile. Use it with calendar events you created yourself, review the restaurant, items, address, fees, tip, total, ETA, and payment method carefully, and only answer "yes" when you intend to place that exact live order.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

High

Confidence: 98% confidence
Finding: This is a true vulnerability because the flow explicitly instructs the agent to click the final 'Place Order' button using a saved login and payment method, but does not require a fresh user confirmation immediately before the irreversible purchase. In a browser-automation skill triggered by calendar events, this creates a realistic risk of unauthorized or mistaken purchases caused by mis-triggering, prompt manipulation, ambiguous requests, or automation errors.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly requires a Chrome profile with saved Grubhub login, payment method, and delivery address, which enables real-world purchases without any user-facing warning about financial impact or a consent checkpoint. In the context of an automation skill that triggers from calendar events and can spawn browser-control sub-agents, this makes unintended or unauthorized charges substantially more likely.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The flow proceeds directly from checkout review to clicking "Place your order" without a mandatory user confirmation at the final irreversible purchase step. Because this action causes a real charge and order submission, omission of a final approval gate creates a significant risk of accidental purchases, prompt-injection-driven purchases, or misuse by an over-permissive agent.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The flow explicitly instructs the agent to click the final "Place order" button using a saved account and payment method, but it does not require a fresh, explicit user confirmation immediately before the irreversible purchase. In the context of calendar-triggered automation, this is especially dangerous because an event parsing mistake, prompt injection elsewhere in the workflow, or agent misinterpretation could result in unauthorized real-money purchases.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The prerequisites require a Chrome profile containing a logged-in Uber account, saved payment method, and delivery address, which exposes highly sensitive personal and financial data to the automation flow without any warning, scoping, or handling safeguards. Because the skill also controls browser actions, compromise or misuse could reveal account details, addresses, order history, or enable unauthorized purchases.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.