Tesla Wrap Workflow

• Outcome: Pass
• Latest audit: Nov 5, 2026 · 12:03 PM UTC
• Version: 1.1.0

Overview

The skill provides a clearly scoped image-design workflow, with no evidence of hidden access, harmful execution, or persistent agent changes.

Use reference images you are comfortable sharing with your chosen image-generation provider. The included validator checks file integrity, dimensions, and size; template geometry and actual in-car appearance require separate checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

official repository https://github.com/teslamotors/custom-wraps and obtain the original template for the matching model and variant. Do not assume Premium, Standard, Performance, or long-range variants share a template based on year alone.
- If inputs are insufficient, complete the theme design first; ask only when a key vehicle detail or the original template is missing. Screenshots can illustrate defects but cannot serve as precise cutter templates. When a readable source file already exists, do not ask the user to re-upload it.
- By default interpret "1 MB" as no more than 1,000,000 bytes per PNG; if the user demands strictly "less than 1 MB", set the validation limit to 999999. Report the total ZIP size separately. Do not treat old software versions, dimension ranges, or upload counts as permanent rules.
- Record current constraints in a batch manifest listing file name, theme, template source, dimensions, logo requirements, and orientation status to be verified. Never write person

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

emium, Standard, Performance, or long-range variants share a template based on year alone.
- If inputs are insufficient, complete the theme design first; ask only when a key vehicle detail or the original template is missing. Screenshots can illustrate defects but cannot serve as precise cutter templates. When a readable source file already exists, do not ask the user to re-upload it.
- By default interpret "1 MB" as no more than 1,000,000 bytes per PNG; if the user demands strictly "less than 1 MB", set the validation limit to 999999. Report the total ZIP size separately. Do not treat old software versions, dimension ranges, or upload counts as permanent rules.
- Record current constraints in a batch manifest listing file name, theme, template source, dimensions, logo requirements, and orientation status to be verified. Never write personal chat screenshots, account information, or private file paths into publicly released material.

## 2. Establish Panel and Orientation Mapping First