restaurant-booking — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited restaurant-booking (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read your credentials from ~/.gooseworks/credentials.json:
export GOOSEWORKS_API_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.gooseworks/credentials.json'))['api_key'])")
export GOOSEWORKS_API_BASE=$(python3 -c "import json;print(json.load(open('$HOME/.gooseworks/credentials.json')).get('api_base','https://api.gooseworks.ai'))")If ~/.gooseworks/credentials.json does not exist, tell the user to run: npx gooseworks login
All endpoints use Bearer auth: -H "Authorization: Bearer $GOOSEWORKS_API_KEY"
Book reservations using Notte browser automation via Orthogonal.
npm install -g @orth/cli) or API keycurl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/start"}'
--body '{"browser_type":"chromium","headless":true,"solve_captchas":true,"idle_timeout_minutes":10}'Save the session_id from the response.
curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"goto","url":"https://www.opentable.com/r/{restaurant}?datetime=2026-02-17T19:00&covers=2"}'curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"click","selector":"button:has-text(\"7:00 PM\")"}'curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"click","selector":"button:has-text(\"Select\")"}'# First name
curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"fill","selector":"input#firstName","value":"John"}'
# Last name
curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"fill","selector":"input#lastName","value":"Doe"}'
# Email
curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"fill","selector":"input#email","value":"[email protected]"}'
# Phone
curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"fill","selector":"input#phoneNumber","value":"4155551234"}'curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"click","selector":"text=I agree to the restaurant"}'curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/execute"}'
--body '{"type":"click","selector":"button:has-text(\"Complete reservation\")"}'curl -s -X POST $GOOSEWORKS_API_BASE/v1/proxy/orthogonal/run \
-H "Authorization: Bearer $GOOSEWORKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"api":"notte","path":"/sessions/{session_id}/page/scrape"}'
--body '{"only_main_content":true}'Look for "confirmed" in the response.
# Start session
curl -X POST "https://api.orth.sh/v1/run" \
-H "Content-Type: application/json" \
-d '{
"api": "notte",
"path": "/sessions/start",
"body": {
"browser_type": "chromium",
"headless": true,
"solve_captchas": true,
"idle_timeout_minutes": 10
}
}'
# Execute actions (same pattern)
curl -X POST "https://api.orth.sh/v1/run" \
-H "Content-Type: application/json" \
-d '{
"api": "notte",
"path": "/sessions/{session_id}/page/execute",
"body": {"type":"goto","url":"https://www.opentable.com/..."}
}'| Field | Selector |
|---|---|
| First name | input#firstName |
| Last name | input#lastName |
input#email | |
| Phone | input#phoneNumber |
| Terms checkbox | text=I agree to the restaurant |
| Submit | button:has-text('Complete reservation') |
| Time slots | button:has-text('7:00 PM') |
| Seating select | button:has-text('Select') |
Search OpenTable and extract from URL:
restref=1906 → Foreign CinemaExample URL format:
https://www.opentable.com/r/{restaurant-slug}?restref={id}&datetime={YYYY-MM-DDTHH:MM}&covers={n}fill action with value param (not type with text)If restaurant uses Resy:
https://resy.com/cities/{city}/venues/{restaurant}?date={YYYY-MM-DD}&seats={n}Similar flow but different selectors. Scrape page first to identify form fields.
gog calendar create~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.