Security audit

瑞玥餐饮API2

Security checks for vulnerabilities and agentic risk

Overview

This restaurant skill looks purpose-aligned, but it can access customer/order data and change reservations/orders or create payment links without consistently documented confirmation and identity checks.

Install only in the intended merchant environment after confirming the backend enforces authorization, session-phone binding, and tenant/shop isolation. Require explicit user confirmation before cancellations, order changes, and payment-link generation, and verify what phone/member data is sent to the backend.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to generate and send a payment URL on payment-related prompts without requiring a visible confirmation step, identity re-check, or warning that a financial link is being produced. In a conversational setting, this raises the risk of unintended payment initiation, link sharing to the wrong recipient, or social-engineering abuse if an attacker can induce the action through ambiguous user input.

Natural-Language Policy Violations

High

Confidence: 90% confidence
Finding: The skill hard-codes a Chinese-only response rule at the highest priority, which can override user language preference and force the agent to ignore accessibility or comprehension needs. This is a policy and trust issue because it reduces informed consent and can cause users to misunderstand sensitive outputs such as reservations, cancellations, or payment instructions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This code automatically forwards contextual identifiers such as saasId, tenantId, shopId, and linkPhone as outbound headers/body fields to backend services, but there is no evidence in this file of notice, consent, minimization, or scoping controls. In a skill that handles reservations, ordering, membership, and transactions, these headers can carry user/session-linked data across trust boundaries and create privacy and data-governance risk if callers or downstream services are broader than expected.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The environment-derived phone number is silently injected into outbound requests via the X-Mobile header whenever linkPhone is absent. Phone numbers are sensitive personal data, and automatic propagation without explicit per-request need, user visibility, or destination restrictions increases the risk of unnecessary disclosure, correlation, and misuse by backend services or logs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly defines multiple state-changing tools such as booking, order placement, cancellation, and reduction, but it does not require any user-facing confirmation or warning before those actions are triggered. In a conversational agent skill, this increases the risk of unintended or socially engineered transactions because the model is instructed to call write tools as part of normal fulfillment, and the backend executes them silently.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The reservation lookup tool allows a phone number to be omitted because it may be 'session-injected', but the manifest does not define when that behavior is permitted or what identity checks must occur first. That ambiguity can lead an agent to fetch appointment data for the wrong user or to rely on unauthenticated session state, creating an insecure direct object reference / privacy exposure risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill exposes member information and transaction history tied to a memberId without any stated consent, authentication, or user-notice requirements. In an agent setting, this increases the chance of silent access to sensitive personal and financial data, especially if the model treats possession of an identifier as sufficient authorization.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skill.json:8