T05 · Unauthorized Access and Privilege Escalation
Error
- Location
findmy-location.py:50- Finding
Full-screen capture transmits excessive sensitive data to an external vision service
- Content
View full analysis
- Remediation
View remediation
Security audit
abe-findmy-location
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-related but needs careful review because it automates Find My, captures full-screen location screenshots, may upload them to an external vision API, and can process the wrong contact.
Install only after the publisher fixes target verification, screenshot minimization, explicit upload consent, cleanup of temporary images, and the Hammerspoon click helper scope. Treat it as a privacy-sensitive Review item, especially if SKILLBOSS_API_KEY is set.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
findmy-location.py:95- Finding
Configured target is ignored, allowing the wrong contact's location to be processed and uploaded
- Content
View full analysis
/dev/null') try: win = json.loads(win_json) bounds = win.get('data', {}).get('windows', [{}])[0].get('bounds', [[0, 0]])[0] wx, wy = bounds[0], bounds[1] except: wx, wy = 0, 0 # Click on second row (first shared contact) hsclick = find_hsclick() click_x, click_y = wx + 120, wy + 173 if hsclick: run(f'{hsclick} click {click_x} {click_y}') else: run(f'peekaboo click --coords {click_x},{click_y} --app "Find My" 2>/dev/null') run('sleep 1') ``` ### Technical Analysis The function obtains the intended contact name through `get_target_name(config)` and stores it in `target`, but never uses that value to locate or select the contact. Instead, it clicks a fixed coordinate documented in the source as the second row or first shared contact. The selected entry therefore depends on the current Find My interface layout, window geometry, sorting order, sidebar state, and contact list contents. The code also does not verify the selected person's identity before capturing or externally processing the location. This breaks the access-control intent established by the configuration. A user can request contact A while the implementation silently selects contact B. If the vision fallback runs, contact B's location may also be transmitted to the external API. ### Attack Path 1. The user sets the configuration target to contact A. 2. The Skill reads that tar ...[truncated 1175 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
findmy-location.py:124- Finding
Sensitive full-screen screenshots are stored in predictable temporary files without cleanup
- Content
View full analysis
/dev/null') img = f"/tmp/findmy-{os.getpid()}.png" run(f'peekaboo image --mode screen --screen-index 0 --path {img} 2>/dev/null') result = { "person": None, "address": None, "city": None, "state": None, "status": None, "context": "unknown", "screenshot": img, "needs_vision": False } ``` ```python elif not result['address']: result['needs_vision'] = True result['context'] = 'out' return result ``` ```python elif result.get('needs_vision') and not result.get('address'): print(f"VISION_NEEDED:{result['screenshot']}") ``` ### Technical Analysis The Skill writes a full-screen screenshot to the global `/tmp` directory using a filename derived only from the process ID. It does not use an atomic secure temporary-file API, does not explicitly enforce restrictive permissions, and does not delete the screenshot after local or remote processing. Process IDs are predictable and reusable. Depending on the behavior of the screenshot utility and local filesystem protections, predictable path construction can expose the operation to local file interference. Independently of such interference, the confidentiality issue is confirmed: the sensitive image remains on disk after the function returns. The retained screenshot can contain a contact's location as well as unrelated screen content. Returning and printing its path intentionally supports later processing when vision is unavailable, but retaining a full-screen image by default is broader than necessary and lacks a defined lifecycle. ### Attack Path 1. The Skill constructs `/tmp/findmy-.png`. 2. It captures the entire primary display into that ...[truncated 1034 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (21)
Tainted flow: 'SKILLBOSS_API_KEY' from os.environ.get (line 11, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python with open(screenshot_path, "rb") as f: img_b64 = base64.b64encode(f.read()).decode() r = requests.post( f"{SKILLBOSS_API_BASE}/pilot", headers={ "Authorization": f"Bearer {SKILLBOSS_API_KEY}",
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README explicitly states that if local landmark matching fails, the skill sends a screenshot of a person's live Find My location to an external vision API. Because the skill is specifically designed for tracking a shared contact's location with street-level accuracy, this can expose highly sensitive location data and nearby map context to a third party without an explicit, prominent privacy warning and consent flow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented purpose understates materially sensitive behavior: GUI automation of Find My, screenshot capture, reading local configuration, and sending screenshots to an external vision service. This mismatch is dangerous because users may authorize the skill for simple location lookup without understanding that it can capture broader screen contents and exfiltrate images off-device.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation does not clearly warn users that screenshots may be transmitted to an external vision API for processing. Because screenshots can contain more than the intended map details, this creates significant exfiltration and privacy risk, particularly in a tool centered on precise geolocation of another person.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
Using shell=True in a generic command runner enables tool-parameter abuse and command injection if any controllable value influences the command string. Since this function is reused for many operations and interpolated values include paths and coordinates, the pattern creates a broad and fragile attack surface.
- Content
python } def run(cmd): return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip() def load_config(): if os.path.exists(CONFIG_PATH):
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A screenshot of the Find My app containing precise location data is uploaded to an external API without any user-facing warning, consent, or data minimization. This is especially dangerous in context because the screenshot may reveal a person's real-time whereabouts, nearby landmarks, and other sensitive map information to a third party.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
server:start()
text Reload config (Hammerspoon menu → Reload Config), then create `~/.local/bin/hsclick`: ```bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
server:start()
text Reload config (Hammerspoon menu → Reload Config), then create `~/.local/bin/hsclick`: ```bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Reload config (Hammerspoon menu → Reload Config), then create
~/.local/bin/hsclick:bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}" chmod +x ~/.local/bin/hsclick
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Reload config (Hammerspoon menu → Reload Config), then create
~/.local/bin/hsclick:bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}" chmod +x ~/.local/bin/hsclick
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares no explicit tool scope even though its documented behavior requires environment access, shell execution, local file access, GUI automation, and network communication. In a security-sensitive skill that captures location data and screenshots, missing permissions metadata prevents users and platforms from accurately assessing or constraining what the skill can do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill handles highly sensitive personal data: a shared contact's precise real-time location, address inference, and screenshots. Failing to present a clear privacy warning increases the chance of covert or poorly understood surveillance use, especially because the output includes street-level location context and stored image paths.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions create a local HTTP server that accepts click coordinates and triggers arbitrary screen clicks. Even if intended for reliability, this exposes a generic UI control primitive that exceeds the stated task and could be abused by any local process to drive clicks in other applications, enabling unintended actions or data access.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests SKILLBOSS_API_KEY = os.environ.get("SKILLBOSS_API_KEY", "") SKILLBOSS_API_BASE = "https://api.heybossai.com/v1" CONFIG_PATH = os.path.expanduser("~/.config/findmy-location/config.json") DEFAULT_CONFIG = {
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill relies on shell execution and GUI automation to control the Find My app, a privileged capability not apparent from the brief description. Hidden automation of a location-tracking app increases risk because users may not realize the skill can manipulate desktop state, click contacts, and capture sensitive UI contents.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 92% confidence
- Finding
The helper wraps arbitrary shell command strings with subprocess.run(..., shell=True), which creates a command-injection primitive if any future or indirect input reaches cmd. In this file, several commands interpolate variables such as executable paths and coordinates, so the unsafe pattern is real even if current inputs are mostly locally derived.
- Content
python } def run(cmd): return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip() def load_config(): if os.path.exists(CONFIG_PATH):
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill reads local USER.md files to infer a target name without user request or clear necessity, expanding data access beyond the stated task. This is dangerous because it silently harvests local profile information and creates an unexpected dependency on unrelated files that may contain sensitive personal context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This outbound request transmits screenshot-derived location data to an external service. In the context of a Find My tracking skill, external transmission materially increases privacy and surveillance risk because it shares precise whereabouts and map context outside the local device boundary.
- Content
python with open(screenshot_path, "rb") as f: img_b64 = base64.b64encode(f.read()).decode() r = requests.post( f"{SKILLBOSS_API_BASE}/pilot", headers={ "Authorization": f"Bearer {SKILLBOSS_API_KEY}",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill automatically opens Find My, brings it frontmost, and clicks a shared contact without disclosure or confirmation. Undisclosed UI automation is risky because it can surprise users, interact with the wrong target, and expose sensitive location data through visible app manipulation or subsequent capture.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill stores a screenshot of Find My in /tmp, which may be accessible to other local processes or persist longer than intended. Because the image can contain highly sensitive real-time location information, leaving it in a shared temporary directory creates unnecessary exposure on the host.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BIN_DIR="$HOME/.local/bin" mkdir -p "$BIN_DIR" mkdir -p "$HOME/.config/findmy-location" # Link the script
Static analysis
No suspicious patterns detected.