T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:407- Finding
Privileged Android Control Interface Exposed over Cleartext HTTP
- Content
View full analysis
cua ping ``` ```text ┌─────────────────────────────────────────────┐ │ Android Device │ │ │ │ :http process main process │ │ ┌──────────────┐ ┌──────────────────┐ │ │ │ BridgeService│ HTTP │ AccessibilityBridge│ │ │ │ NanoHTTPD │─────→│ A11yInternalServer│ │ │ │ 0.0.0.0:7333│proxy │ 127.0.0.1:7334 │ │ │ └──────────────┘ └──────────────────┘ │ │ ↑ auth+CORS ↑ a11y service │ │ ↑ auto-unlock ↑ gesture dispatch │ │ ↑ config/status ↑ tree traversal │ └────────────────────────────────────────────── ┘ ↑ HTTP ┌────────────┐ │ Agent/CLI │ cua commands / curl └────────────┘ ``` ### Technical Analysis The documented bridge listens on `0.0.0.0:7333`, exposing the service on every available network interface. Communication between the client and the device is explicitly described as HTTP. Although the architecture mentions authentication, it does not document TLS, certificate validation, request signing, nonce-based replay protection, or another secure transport. A bearer token transmitted over cleartext HTTP may be observed by an attacker with access to the same network path. HTTP request and response bodies may also expose screenshots, UI trees, clipboard contents, messages, contacts, files, location information, and action parameters. The API is particularly sensitive because the documented capabilities include accessibility actions, application launching, calls, SMS operations, camera access, file operations, clipboard access, location retrieval, device unlocking, and automated permission management. Exposu ...[truncated 1845 chars]- Remediation
View remediation