pp-table-reservation-goat
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a CLI tool using
npx -y @mvanhorn/printing-press, which fetches and executes code from the official NPM registry. - [COMMAND_EXECUTION]: The skill's operation relies on the execution of the
table-reservation-goat-pp-clibinary through the shell to perform reservation queries and management. - [CREDENTIALS_UNSAFE]: The tool includes functionality (
auth login --chrome) to import session cookies from the local Chrome browser profile to authenticate with OpenTable and Tock. - [DATA_EXFILTRATION]: The CLI tool features a
--deliver webhook:<url>flag and afeedbackcommand that allow command results and feedback notes to be sent to external network endpoints. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface:
- Ingestion points: The agent processes data from external APIs (OpenTable, Tock, Resy) including restaurant names, descriptions, and location details.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content within the external API responses.
- Capability inventory: The agent can execute shell commands and interact with the local file system through the provided CLI tool.
- Sanitization: There is no mentioned validation or sanitization of the content retrieved from external sources before it enters the agent's context.
Audit Metadata