ClawHub
Back to skill

Security audit

Meshtastic Detection

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate Meshtastic alerting purpose, but its deployment and alert workflow expose more machine and messaging authority than users should accept without review.

Install only if you are comfortable running a persistent hardware-facing receiver. Before use, remove privileged Docker mode, verify the Feishu recipient, restrict the cron session/tools as tightly as possible, treat sensor text as untrusted data, and prefer pinned dependencies or a reviewed environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T01 · Skill Instruction Hijacking

Warning
Location
scripts/usb_receiver.py:174
Finding

Untrusted Meshtastic Payloads Are Processed by an Agent-Driven Notification Workflow

Content
View full analysis
&& ./venv/bin/python scripts/event_monitor.py — If alert_count > 0, tell me how many alerts there are, and the latest sender and time. If alert_count is 0, reply: No new alerts." \ --announce \ --channel feishu \ --to ``` ### Technical Analysis A Meshtastic sender controls the detection payload stored in the `text` field. The receiver performs no schema restriction, semantic validation, control-character filtering, or maximum-length enforcement before persisting that text. `event_monitor.py` then emits the value as JSON that a scheduled AI Agent is instructed to interpret and report. Although JSON encoding prevents conventional shell injection, it does not establish a safe instruction boundary for a language model. A payload such as an instruction to ignore the s ...[truncated 1683 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Python Dependencies Are Installed Without Exact Version or Integrity Pinning

Content
View full analysis
=2.0 pypubsub ``` The setup script installs whatever versions satisfy these unconstrained declarations: ```bash info "Installing Python dependencies..." ./venv/bin/pip install --upgrade pip -q 2>/dev/null || true ./venv/bin/pip install -q -r requirements.txt ``` ### Technical Analysis `meshtastic>=2.0` permits any future Meshtastic release, while `pypubsub` has no version constraint at all. Neither dependency has an integrity hash, and transitive dependencies are also not locked. Consequently, identical project source can install materially different code depending on when setup runs. A compromised package maintainer account, package-index incident, malicious future release, or compromised transitive dependency could introduce attacker-controlled code after this Skill has been reviewed. Python package installation may execute build-system code. Installed packages are also imported by the long-running receiver, creating an additional runtime execution path. ### Attack Path 1. A direct or transitive dependency publishes a compromised version that still satisfies the requirements. 2. A user runs `setup.sh`. 3. `pip` resolves the compromised release from the configured package index. 4. Malicious code executes during package build or installation, or later when `usb_receiver.py` imports the package. 5. The code runs with the privileges of the account that launched setup or the receiver service. ### Impact Assessment A compromised dependency can execute arbitrary code as the installation or service account. It may access local Skill files, sensor records, the mapped serial device, environment variables, and any credentials readable by that account. If users incorrectly run setup as root or deploy the receiver in the documented privilege ...[truncated 171 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
setup.sh:96
Finding

Setup Downloads and Executes Mutable Remote Bootstrap Code Without Integrity Verification

Content
View full analysis
/dev/null; then yellow "venv created without pip; bootstrapping pip..." GET_PIP="$SCRIPT_DIR/.get-pip.py" if command -v curl &>/dev/null; then curl -sSL https://bootstrap.pypa.io/get-pip.py -o "$GET_PIP" elif command -v wget &>/dev/null; then wget -q -O "$GET_PIP" https://bootstrap.pypa.io/get-pip.py else "$PYTHON" -c "import urllib.request; urllib.request.urlretrieve('https://bootstrap.pypa.io/get-pip.py', '$GET_PIP')" fi ./venv/bin/python "$GET_PIP" rm -f "$GET_PIP" VENV_CREATED=true fi fi ``` ### Technical Analysis When `ensurepip` is unavailable, setup retrieves `get-pip.py` from a remote URL and immediately executes it. HTTPS protects ordinary transport integrity, and the URL belongs to the official PyPA bootstrap service, so this behavior is not evidence of deliberate malicious intent. However, the retrieved object is mutable and is not checked against a pinned digest or verified signature. The effective code executed by setup can therefore change independently of the reviewed Skill package. A compromise of the upstream service, CDN, DNS/TLS trust chain, or local network trust configuration could replace the bootstrap script. The quiet download options also reduce user visibility into the retrieval process. ### Attack Path 1. An environment without functional `ensurepip` runs `setup.sh`. 2. An attacker compromises the upstream bootstrap resource or another trusted component in the delivery chain. 3. Setup downloads the modified `get-pip.py` without checking its expected digest. 4. `./venv/bin/python "$GET_PIP"` executes ...[truncated 528 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
README.md:104
Finding

Docker Deployment Example Grants Full Privileged Container Access Unnecessarily

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (78)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

Install as System Service

setup.sh automatically generates a service file for your platform. Follow the output instructions, or:

Linux / Raspberry Pi (systemd):

bash

Privileged Kubernetes Workload

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The docker-compose example includes privileged: true, which substantially reduces container isolation and can expose the host if the container or skill code is compromised. Because the skill already mounts a specific serial device, full privileged mode is broader than necessary and materially increases risk.

Content

Scanner excerpt · README.md (reported line 113)May include surrounding context.

md
working_dir: /app/skills/meshtastic-detection
    command: ./entrypoint.sh
    restart: always
    privileged: true
    devices:
      - /dev/ttyACM0:/dev/ttyACM0
    volumes:

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 230)May include surrounding context.

  • If alert_count = 0: Reply HEARTBEAT_OK (do not send a message)

Important: You must use the message tool with action=send to send the message to Feishu.

text

Replace `<feishu-open-id>` with the recipient's Feishu open_id (e.g. `ou_9b2c3a662d7a314f2d9a3a893f29cc3c`).

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

Mapping a host device into a container with --device /dev/ttyACM0:/dev/ttyACM0 weakens isolation and grants the container direct access to physical hardware. In this skill's context the access is functionally required, but it still increases the blast radius if the receiver process or its dependencies are compromised.

Content

Scanner excerpt · README.md (reported line 291)May include surrounding context.

md
**Docker serial access (/dev/ttyACM0 permission issues)**
- On the host, mount the device into the container:
  - `docker run --device /dev/ttyACM0:/dev/ttyACM0 ...`
  - Or in docker-compose:
    - `devices:`
      - `/dev/ttyACM0:/dev/ttyACM0`

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The README explicitly recommends docker run --privileged as a temporary workaround for serial permission issues. A privileged container effectively disables many container isolation boundaries and can expose the host to device, kernel, or filesystem abuse if the container or included code is compromised.

Content

Scanner excerpt · README.md (reported line 296)May include surrounding context.

md
- `devices:`
      - `/dev/ttyACM0:/dev/ttyACM0`
- If you still get `Permission denied`, you can temporarily run a privileged container (recommended only for testing):
  - `docker run --privileged ...`
  - Or in docker-compose:`privileged: true`
- In production, a safer approach is to mount only the required devices and avoid using `privileged: true` long term.

Privileged Kubernetes Workload

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The troubleshooting section recommends docker run --privileged, which grants near-host-level access and meaningfully raises the chance of container escape or host compromise. Even when framed as temporary, such guidance can normalize an unsafe deployment pattern for users.

Content

Scanner excerpt · README.md (reported line 297)May include surrounding context.

md
- `/dev/ttyACM0:/dev/ttyACM0`
- If you still get `Permission denied`, you can temporarily run a privileged container (recommended only for testing):
  - `docker run --privileged ...`
  - Or in docker-compose:`privileged: true`
- In production, a safer approach is to mount only the required devices and avoid using `privileged: true` long term.

**Raspberry Pi / Debian: ensurepip not available**

Privileged Kubernetes Workload

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The explicit privileged: true compose guidance in troubleshooting presents the same host-exposure risk as --privileged. In the context of a hardware-facing skill, users may be tempted to adopt it permanently, making the documentation more dangerous than a purely theoretical mention.

Content

Scanner excerpt · README.md (reported line 298)May include surrounding context.

md
- If you still get `Permission denied`, you can temporarily run a privileged container (recommended only for testing):
  - `docker run --privileged ...`
  - Or in docker-compose:`privileged: true`
- In production, a safer approach is to mount only the required devices and avoid using `privileged: true` long term.

**Raspberry Pi / Debian: ensurepip not available**
- `setup.sh` will auto-detect and install the missing `python3.X-venv` package via apt.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill promises immediate user alerting on sensor trigger, but the file itself only documents commands and references external mechanisms rather than implementing or guaranteeing notification behavior. Security-wise, this can cause false assumptions about incident response coverage, leading users to rely on a detection-and-alert workflow that may silently fail or be incomplete while still storing sensitive event data locally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill promises immediate user alerting on sensor trigger, but the file itself only documents commands and references external mechanisms rather than implementing or guaranteeing notification behavior. Security-wise, this can cause false assumptions about incident response coverage, leading users to rely on a detection-and-alert workflow that may silently fail or be incomplete while still storing sensitive event data locally.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · setup.sh (reported line 123)May include surrounding context.

sh
if command -v apt &>/dev/null; then
      yellow "ensurepip not available — trying: sudo apt install $venv_pkg ..."
      if (command -v sudo &>/dev/null && sudo apt-get update -qq && sudo apt-get install -y -qq "$venv_pkg") 2>/dev/null; then
        if "$PYTHON" -m venv venv; then
          VENV_CREATED=true
        fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 84)May include surrounding context.

md
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 85)May include surrounding context.

md
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 88)May include surrounding context.

md
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 267)May include surrounding context.

md
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 196)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 197)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 199)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 200)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 208)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 210)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 213)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 214)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 217)May include surrounding context.

sh
| Platform | Serial port pattern | Service manager |
|----------|-------------------|-----------------|
| macOS | `/dev/cu.usbmodem*` | launchd (plist) |
| Linux x86/arm | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Raspberry Pi | `/dev/ttyUSB*`, `/dev/ttyACM*` | systemd |
| Docker | `/dev/ttyUSB*`, `/dev/ttyACM*` | entrypoint.sh + `nohup` / container CMD |

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

bash
sudo cp meshtastic-detection.generated.service /etc/systemd/system/meshtastic-detection.service
sudo systemctl daemon-reload
sudo systemctl enable --now meshtastic-detection

# Check status
sudo systemctl status meshtastic-detection