Security audit

MicroPython Skills

Security checks for vulnerabilities and agentic risk

Overview

This MicroPython hardware skill fits its stated purpose, but it needs review because it can persistently enable wireless device access, handle credentials unsafely, broaden serial-port access, and flash unverified firmware.

Install only if you are comfortable letting the agent control connected microcontroller hardware. Prefer USB over WebREPL, avoid the default WebREPL password, do not use chmod 666 for serial access, review any boot.py/main.py changes before running WiFi setup, and verify firmware sources before flashing because flashing can erase or permanently change the device.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wifi_setup.py:60
Finding: Persistent WebREPL Provisioning Exposes Plaintext Credentials and Bypasses Dangerous-Operation Confirmation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/webrepl_exec.py:37
Finding: WebREPL Transmits Authentication Credentials and Executable Code Without Encryption or Endpoint Authentication
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/firmware_flash.py:147
Finding: Firmware Flashing Trusts Unverified Downloads and a Poisonable Shared Temporary Cache
Content: View full analysis
10000: return local_path, f"Using cached firmware: {filename}" print(f"Downloading: {url}") print(f"Saving to: {local_path}") try: req = urllib.request.Request( url, headers={"User-Agent": "micropython-skills/1.0"} ) with urllib.request.urlopen(req, timeout=60) as resp: data = resp.read() with open(local_path, "wb") as f: f.write(data) size_kb = len(data) // 1024 return local_path, f"Downloaded {filename} ({size_kb} KB)" except Exception as e: return None, f"Download failed: {e}" ``` ```python def write_flash(esptool_cmd, port, chip_arg, flash_addr, firmware_path): """Write firmware to flash.""" print(f"Flashing firmware to {flash_addr}...") stdout, stderr, rc = run_cmd( [ esptool_cmd, "--chip", chip_arg, "--port", port, "--baud", "460800", "write_flash", "-z", flash_addr, firmware_path, ], timeout=120 ) ``` ### Technical Analysis Firmware is downloaded over HTTPS from the official MicroPython domain, but the script does not authenticate the firmware artifact itself using a checksum, signed manifest, or digital signature. Transport encryption alone does not protect against a compromised origin, compromised certificate authority, local trust-store manipulation, or cache tampering. The cac ...[truncated 1857 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/device_probe.py:210
Finding: Recommended Serial-Port Permission Fix Grants Device Access to Every Local User
Content: View full analysis
Remediation: View remediation
` rather than world permissions. - Verify the selected serial port before changing permissions. - Explain that the user may need to log out and back in after a group-membership change. - Avoid recommending administrative commands without describing their security effect. ]]>

T08 · Insecure Dependencies

Warning

Location: references/connections.md:52
Finding: Unpinned Dependency Installation and Arbitrary Remote Package Source Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (53)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
- "SKILL.md"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
- "scripts/firmware_flash.py"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
- "scripts/firmware_flash.py"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.
md
- "scripts/firmware_flash.py"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
- "scripts/firmware_flash.py"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The suggested parameter 666 is itself the problem: it applies overly permissive access to the serial device and turns a troubleshooting step into a broad host-side security bypass. In a tool-using agent setting, hardcoded unsafe parameters are especially dangerous because they can be repeated automatically and without nuanced operator review.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
- `status: "ok"` → Device has MicroPython, proceed to step 2 - `status: "no_firmware"` → ESP chip detected but no MicroPython. Ask user to confirm, then flash: `python3 {SKILL_DIR}/scripts/firmware_flash.py --port PORT --yes` - `status: "no_device"` → No device connected. Guide user to connect hardware. - `status: "permission_denied"` → Serial port not accessible. On Linux: `sudo chmod 666 /dev/ttyACM0`. On Windows: check Device Manager for driver issues. 2. **Connect** — Default: USB via mpremote. Optional: WiFi via WebREPL (user must request) 3. **Execute** — Generate MicroPython code and push to device 4. **Parse** — Scan stdout for tagged lines (RESULT:/ERROR:/STATUS:/LOG:)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The tool guidance embeds a dangerous parameter choice, 'chmod 666', that weakens host security controls as part of normal troubleshooting. Even though the script does not execute the command itself, the skill can induce insecure operator behavior, which is especially risky for an AI-assisted hardware-management workflow.
Content: Scanner excerpt · scripts/device_probe.py (reported line 244)May include surrounding context.
python
if "not readable" in combined.lower() or "permission" in combined.lower(): if sys.platform == "win32": return None, f"Permission denied on {port}. Check Device Manager for driver issues." return None, f"Permission denied on {port}. Run: sudo chmod 666 {port}" # Check for connection error if rc != 0 and ("failed" in combined.lower() or "error" in combined.lower()):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: This second instance repeats the same unsafe tool-parameter recommendation in structured output intended to guide the user. Because users may copy-paste remediation text verbatim, this increases the likelihood of insecure host configuration.
Content: Scanner excerpt · scripts/device_probe.py (reported line 344)May include surrounding context.
python
"fix": ( "Check Device Manager — the COM port driver may need reinstalling" if sys.platform == "win32" else f"Run: sudo chmod 666 {port}" ), } print(json.dumps(result, indent=2))

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This is a true parameter-abuse/safety issue because the tool encourages a dangerously overbroad permission change on a user-supplied device path. Even though it is only printed as advice, in practice users often copy-paste such remediation, and on a firmware-flashing tool that can erase and rewrite hardware, the resulting access expansion materially increases the attack surface.
Content: Scanner excerpt · scripts/firmware_flash.py (reported line 94)May include surrounding context.
python
if "not readable" in combined.lower() or "permission" in combined.lower(): if sys.platform == "win32": return None, f"Permission denied on {port}. Check Device Manager for driver issues." return None, f"Permission denied on {port}. Run: sudo chmod 666 {port}" chip_match = re.search(r"Chip is (ESP\S+)", combined, re.IGNORECASE) if chip_match:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes capabilities that include shell execution, file reads/writes, and network access, but it does not declare any explicit tool scope or permission boundary. In an agent environment, that increases the chance the skill is invoked with broader-than-necessary privileges, enabling unintended host actions beyond the microcontroller workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger description is extremely broad and includes many generic hardware and networking terms, making accidental activation likely. Over-broad activation can cause the agent to enter a workflow that performs device probing, shell commands, network activity, or code generation when the user's intent was only conversational or informational.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
- "scripts/firmware_flash.py" - "scripts/wifi_setup.py" - "scripts/webrepl_exec.py" - "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
md
- "scripts/firmware_flash.py" - "scripts/wifi_setup.py" - "scripts/webrepl_exec.py" - "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
- "scripts/wifi_setup.py" - "scripts/webrepl_exec.py" - "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
- "scripts/wifi_setup.py" - "scripts/webrepl_exec.py" - "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
- "scripts/webrepl_exec.py" - "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md" - "references/connections.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
- "scripts/webrepl_exec.py" - "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md" - "references/connections.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md" - "references/connections.md" - "references/esp32.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
- "skills/sensor/SKILL.md" - "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md" - "references/connections.md" - "references/esp32.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md" - "references/connections.md" - "references/esp32.md" - "references/safety.md"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
- "skills/actuator/SKILL.md" - "skills/network/SKILL.md" - "skills/diagnostic/SKILL.md" - "skills/algorithm/SKILL.md" - "references/connections.md" - "references/esp32.md" - "references/safety.md"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Using chmod 666 on a serial device is an over-broad permission change that can expose the port to unintended local access. Because this skill already has shell-oriented behavior and hardware control scope, recommending this command materially increases the risk of unsafe host modification during normal operation.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
- `status: "ok"` → Device has MicroPython, proceed to step 2 - `status: "no_firmware"` → ESP chip detected but no MicroPython. Ask user to confirm, then flash: `python3 {SKILL_DIR}/scripts/firmware_flash.py --port PORT --yes` - `status: "no_device"` → No device connected. Guide user to connect hardware. - `status: "permission_denied"` → Serial port not accessible. On Linux: `sudo chmod 666 /dev/ttyACM0`. On Windows: check Device Manager for driver issues. 2. **Connect** — Default: USB via mpremote. Optional: WiFi via WebREPL (user must request) 3. **Execute** — Generate MicroPython code and push to device 4. **Parse** — Scan stdout for tagged lines (RESULT:/ERROR:/STATUS:/LOG:)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Using chmod 666 on a serial device is an over-broad permission change that can expose the port to unintended local access. Because this skill already has shell-oriented behavior and hardware control scope, recommending this command materially increases the risk of unsafe host modification during normal operation.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
- `status: "ok"` → Device has MicroPython, proceed to step 2 - `status: "no_firmware"` → ESP chip detected but no MicroPython. Ask user to confirm, then flash: `python3 {SKILL_DIR}/scripts/firmware_flash.py --port PORT --yes` - `status: "no_device"` → No device connected. Guide user to connect hardware. - `status: "permission_denied"` → Serial port not accessible. On Linux: `sudo chmod 666 /dev/ttyACM0`. On Windows: check Device Manager for driver issues. 2. **Connect** — Default: USB via mpremote. Optional: WiFi via WebREPL (user must request) 3. **Execute** — Generate MicroPython code and push to device 4. **Parse** — Scan stdout for tagged lines (RESULT:/ERROR:/STATUS:/LOG:)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: All user-facing prompt examples in this file are presented in Chinese, which may imply a fixed language expectation without offering user choice. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation includes commands that delete or overwrite files on the microcontroller without clearly warning that these actions can permanently alter device behavior or erase user code. In a hardware-programming skill, users may copy-paste commands directly, so omission of a data-loss warning increases the chance of accidental device disruption.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.