Security audit
Security checks across malware telemetry and agentic risk
This is a legitimate MicroPython hardware-control skill, but it needs review because it can persistently modify devices, enable remote access, expose credentials, and recommends unsafe serial-port permissions.
Install only if you are comfortable giving an agent control over connected microcontroller boards. Prefer USB, avoid WebREPL on untrusted networks, set a strong non-default WebREPL password, keep WiFi credentials out of logs and shell history, back up `boot.py`/`main.py` before changes, and do not use the suggested `chmod 666` workaround; use group membership, udev rules, or a user-scoped ACL instead.
import urequests, json
try:
data = {"sensor": "dht22", "temp": 23.5}
r = urequests.post(
"http://example.com/api/data",
json=data,
headers={"Content-Type": "application/json"}import urequests, json
try:
data = {"sensor": "dht22", "temp": 23.5}
r = urequests.post(
"http://example.com/api/data",
json=data,
headers={"Content-Type": "application/json"}- `status: "ok"` → Device has MicroPython, proceed to step 2
- `status: "no_firmware"` → ESP chip detected but no MicroPython. Ask user to confirm, then flash: `python3 {SKILL_DIR}/scripts/firmware_flash.py --port PORT --yes`
- `status: "no_device"` → No device connected. Guide user to connect hardware.
- `status: "permission_denied"` → Serial port not accessible. On Linux: `sudo chmod 666 /dev/ttyACM0`. On Windows: check Device Manager for driver issues.
2. **Connect** — Default: USB via mpremote. Optional: WiFi via WebREPL (user must request)
3. **Execute** — Generate MicroPython code and push to device
4. **Parse** — Scan stdout for tagged lines (RESULT:/ERROR:/STATUS:/LOG:)- `status: "ok"` → Device has MicroPython, proceed to step 2
- `status: "no_firmware"` → ESP chip detected but no MicroPython. Ask user to confirm, then flash: `python3 {SKILL_DIR}/scripts/firmware_flash.py --port PORT --yes`
- `status: "no_device"` → No device connected. Guide user to connect hardware.
- `status: "permission_denied"` → Serial port not accessible. On Linux: `sudo chmod 666 /dev/ttyACM0`. On Windows: check Device Manager for driver issues.
2. **Connect** — Default: USB via mpremote. Optional: WiFi via WebREPL (user must request)
3. **Execute** — Generate MicroPython code and push to device
4. **Parse** — Scan stdout for tagged lines (RESULT:/ERROR:/STATUS:/LOG:)if "not readable" in combined.lower() or "permission" in combined.lower():
if sys.platform == "win32":
return None, f"Permission denied on {port}. Check Device Manager for driver issues."
return None, f"Permission denied on {port}. Run: sudo chmod 666 {port}"
# Check for connection error
if rc != 0 and ("failed" in combined.lower() or "error" in combined.lower()):"fix": (
"Check Device Manager — the COM port driver may need reinstalling"
if sys.platform == "win32"
else f"Run: sudo chmod 666 {port}"
),
}
print(json.dumps(result, indent=2))if "not readable" in combined.lower() or "permission" in combined.lower():
if sys.platform == "win32":
return None, f"Permission denied on {port}. Check Device Manager for driver issues."
return None, f"Permission denied on {port}. Run: sudo chmod 666 {port}"
# Check for connection error
if rc != 0 and ("failed" in combined.lower() or "error" in combined.lower()):"fix": (
"Check Device Manager — the COM port driver may need reinstalling"
if sys.platform == "win32"
else f"Run: sudo chmod 666 {port}"
),
}
print(json.dumps(result, indent=2))- `status: "ok"` → Device has MicroPython, proceed to step 2
- `status: "no_firmware"` → ESP chip detected but no MicroPython. Ask user to confirm, then flash: `python3 {SKILL_DIR}/scripts/firmware_flash.py --port PORT --yes`
- `status: "no_device"` → No device connected. Guide user to connect hardware.
- `status: "permission_denied"` → Serial port not accessible. On Linux: `sudo chmod 666 /dev/ttyACM0`. On Windows: check Device Manager for driver issues.
2. **Connect** — Default: USB via mpremote. Optional: WiFi via WebREPL (user must request)
3. **Execute** — Generate MicroPython code and push to device
4. **Parse** — Scan stdout for tagged lines (RESULT:/ERROR:/STATUS:/LOG:)if "not readable" in combined.lower() or "permission" in combined.lower():
if sys.platform == "win32":
return None, f"Permission denied on {port}. Check Device Manager for driver issues."
return None, f"Permission denied on {port}. Run: sudo chmod 666 {port}"
# Check for connection error
if rc != 0 and ("failed" in combined.lower() or "error" in combined.lower()):"fix": (
"Check Device Manager — the COM port driver may need reinstalling"
if sys.platform == "win32"
else f"Run: sudo chmod 666 {port}"
),
}
print(json.dumps(result, indent=2))66/66 vendors flagged this skill as clean.
No suspicious patterns detected.