Android Node

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but its install and network setup require careful review before use.

Review this skill before installing. Avoid the remote curl-to-bash flow; use only inspected local setup code, verify downloaded binaries, and run the phone node only on a trusted isolated network. Do not send sensitive prompts unless traffic is protected by an authenticated encrypted channel or trusted overlay network.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Unverified Remote Installation Script Is Piped Directly to Bash

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: setup.sh:15

Finding

Mutable Ollama Executable Is Downloaded and Run Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: setup.sh:38

Finding

Ollama Service Is Exposed on All Interfaces Without Access Controls

Content

View full analysis

$HOME/start_node.sh << 'EOF' #!/data/data/com.termux/files/usr/bin/bash export PATH="$HOME/bin:$PATH" export OLLAMA_HOST=0.0.0.0:11434 echo "Starting Ollama node on port 11434..." ollama serve EOF ``` ### Technical Analysis `OLLAMA_HOST=0.0.0.0:11434` binds the Ollama service to every available IPv4 interface. The configuration provides no authentication, TLS, source allowlist, firewall rule, or authenticated reverse proxy. LAN accessibility is part of the declared node functionality, but exposing the service on all interfaces is broader than the minimum necessary. Its actual reachability depends on Android, Termux, router, and firewall configuration, but any host capable of reaching port 11434 can attempt to use the API. ### Attack Path 1. The user launches `~/start_node.sh`. 2. Ollama listens on port 11434 across all available interfaces. 3. An attacker on the same Wi-Fi network—or another network with a route or forwarded port to the phone—discovers the open service. 4. The attacker sends requests directly to Ollama's unauthenticated API. 5. The attacker consumes inference resources, enumerates exposed API information, or invokes other operations supported by the installed Ollama version. ### Impact Assessment A reachable attacker may: - Consume phone CPU, memory, battery, and thermal capacity through inference requests. - Cause denial of service or degraded availability for legitimate jobs. - Query available API endpoints and models. - Submit attacker-selected prompts or workloads. - Exploit any separate vulnerability present in the exposed Ollama version. This finding exposes the Ollama service rather than the Android operating system directly. The ultimate process privileges are those of Termux, while network abuse is limited to fu ...[truncated 76 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: phone_nodes.py:76

Finding

Inference Prompts and Responses Are Transmitted Over Plaintext HTTP

Content

View full analysis

:11434` endpoint. 2. The router calls `phone_nodes.call()` with conversation messages. 3. The mo ...[truncated 915 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and executing an external script from albionwakes.com creates a supply-chain risk: if the server, DNS, TLS termination, or hosting account is compromised, arbitrary code will run on the target phone. Because the phone is being turned into a network-reachable inference worker, compromise could also be used to pivot into the local Wi‑Fi environment or tamper with model-serving behavior.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

On the phone (run in Termux)

bash

curl -s https://albionwakes.com/phone_setup.sh | bash
bash ~/start_node.sh

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of '| bash' is a classic command-chaining anti-pattern that removes any opportunity for the user or tooling to inspect the downloaded content before execution. This makes transient compromise especially dangerous, since a single modified response from the remote endpoint results in immediate arbitrary shell execution.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

On the phone (run in Termux)

bash

curl -s https://albionwakes.com/phone_setup.sh | bash
bash ~/start_node.sh

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The usage line fetches a script from a remote domain and executes it immediately in the shell, which is a classic arbitrary code execution risk. The danger is increased because the URL uses plain HTTP rather than HTTPS, allowing tampering in transit as well as server-side compromise to deliver malicious code.

Content

Scanner excerpt · setup.sh (reported line 6)May include surrounding context.

sh

# After this runs, Pi can route inference jobs to this phone.
#
# Usage: paste this URL in Termux browser, or:
#   curl -s http://albionwakes.com/phone_setup.sh | bash

set -e

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping network-fetched content directly into bash bypasses review and turns any upstream compromise or network interception into immediate shell execution. Because this setup script performs installation and persistence-related actions, the resulting blast radius on the device is substantial.

Content

Scanner excerpt · setup.sh (reported line 6)May include surrounding context.

sh

# After this runs, Pi can route inference jobs to this phone.
#
# Usage: paste this URL in Termux browser, or:
#   curl -s http://albionwakes.com/phone_setup.sh | bash

set -e

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · setup.sh (reported line 29)May include surrounding context.

sh

"aarch64" ]; then
    OLLAMA_URL="https://github.com/ollama/ollama/releases/latest/download/ollama-linux-arm64"
else
    OLLAMA_URL="https://github.com/ollama/ollama/releases/latest/download/ollama-linux-amd64"
fi

mkdir -p $HOME/bin
wget -q -O $HOME/bin/ollama "$OLLAMA_URL"
chmod +x $HOME/bin/ollama
export PATH="$HOME/bin:$PATH"

# Persist PATH
grep -q 'albion-node' $HOME/.bashrc 2>/dev/null || echo '# albion-node' >> $HOME/.bashrc
grep -q '$HOME/bin' $HOME/.bashrc 2>/dev/null || echo 'export PATH="$HOME/bin:$PATH"' >> $HOME/.bashrc

echo "Pulling default model (qwen2.5:0.5b — 394MB)..."
$HOME/bin/ollama pull qwen2.5:0.5b

# Write a startup script
cat > $HOME/start_node.sh << 'EOF'
#!/data/data/com.termux/files/usr/bin/bash
export PATH="$HOME/bin:$PATH"
export OLLAMA_HOST=0.0.0.0:11434
echo "Starting Ollama node on port 11434..."
ollama serve
EOF
chmod +x $HOME/start_node.sh

echo ""
echo "=== Done ==="
echo ""
echo "To start the node:"
echo "  bash ~/start_node.sh"
echo ""
echo "T

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remotely hosted shell script directly via curl-to-bash, which gives the remote server immediate code execution on the Android Termux environment without inspection, pinning, or integrity verification. In this context, the script provisions an inference node and could install backdoors, exfiltrate local data, or expose the device and adjacent network resources.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The module sends full chat messages to arbitrary URLs stored in the local node registry over plain HTTP, with no authentication, encryption, or trust validation of the destination. If an attacker can modify the registry, control the network, or register a malicious node, they can intercept sensitive prompts/responses or impersonate a healthy inference endpoint.

Content

Scanner excerpt · phone_nodes.py (reported line 84)May include surrounding context.

python

if system_override:
            msgs = [{'role': 'system', 'content': system_override}] + [m for m in msgs if m.get('role') != 'system']
        try:
            r = requests.post(url, json={
                'model': model, 'messages': msgs, 'stream': False,
                'options': {'temperature': 0.7, 'num_predict': 1024},
            }, timeout=CALL_TIMEOUT)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sends the full messages payload, and optionally a system override, over HTTP to configured phone nodes via requests.post. While network transmission is core functionality here, this file provides no user-facing warning in comments, docstrings, or logs that conversational content will be sent to external devices on the local network.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script explicitly instructs users to execute a remotely hosted script directly via curl-to-bash, eliminating any opportunity to inspect the content before execution. In this context, that remote script performs package installation, downloads a binary, alters shell startup files, and prepares a network-reachable service, so compromise of the hosting site or traffic path could immediately lead to arbitrary code execution on the device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script downloads and runs substantial third-party software, pulls a model, and creates a startup script that binds the service to 0.0.0.0, making it network-accessible, yet provides no meaningful safety warning about exposure or trust assumptions. In a mobile/Termux context, exposing a local inference service to the network can unintentionally widen the attack surface and enable unauthorized access from the local network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script silently appends PATH changes to ~/.bashrc, creating persistent environment modification without clear prior consent. While not inherently malicious here, silent persistence reduces transparency and can have unintended side effects or normalize unsafe installation behavior.

Content

No source excerpt is available for this finding.