Security audit

瑞玥餐饮API

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed restaurant booking and ordering integration, with real business-write power that users should install only for the intended tenant/shop context.

Install this only for the intended restaurant tenant/shop and ensure the platform injects the correct tenant, shop, SaaS, and phone context. Treat cancellation, order reduction, and payment-link tools as real business actions, and require clear user confirmation before invoking them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill embeds operational capabilities that rely on environment-injected identifiers and direct network access to an internal API, but it does not declare those permissions explicitly. That creates a trust and review gap: deployers may approve the skill without realizing it can access internal services and tenant/shop-scoped data, increasing the risk of unintended data access, SSRF-style abuse through configurable base URLs, or misuse of privileged context.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This handler performs an order-cancellation write operation, but the declared skill capabilities reportedly only include reservation, ordering, and item reduction. A capability mismatch is security-relevant because upstream policy, approval, or user-consent controls may rely on the manifest; an undeclared destructive action can therefore bypass expected governance and enable unauthorized cancellations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code automatically attaches contextual identifiers such as X-Saas-Id, X-Tenant-Id, X-Shop-Id, and X-Mobile to outbound requests, but this file contains no consent, minimization, or disclosure controls. In a dining/appointment skill, these headers can reveal tenant, store, and user phone context to downstream services beyond what a user may expect, increasing privacy and cross-tenant data exposure risk if the backend or routing is misconfigured.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Environment-derived values such as forced shop, tenant, saas, and link phone are injected into requests as defaults, causing hidden contextual data to be sent even when not explicitly provided by the caller. This is risky because it can silently bind requests to a merchant, tenant, or phone number, enabling unintended data disclosure, confusing authorization boundaries, or cross-tenant mistakes if environment configuration is wrong.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The cancelAppointment tool performs a destructive action, but its description does not require an explicit confirmation step or strong identity binding before cancellation. In a conversational environment, ambiguous user phrasing, prompt confusion, or session mix-ups could cause unintended reservation cancellation, impacting availability of the user's booking.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The reduceOrder tool changes an existing order but does not document a confirmation requirement before modifying quantities or removing items. This can lead to accidental order tampering from ambiguous utterances or mistaken item resolution, especially because conversational references like 'remove the soup' may be unclear.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The cancelOrder tool cancels an entire order, yet the description only says '用户确认 orderId 后调用' and lacks stronger safeguards for confirmation and ownership validation. If the assistant obtains or infers an orderId incorrectly, a full order could be cancelled without sufficient user awareness, causing material business and user impact.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skill.json:8