Security audit

Tessie Tesla Control

Security checks across malware telemetry and agentic risk

Overview

This Tessie/Tesla skill is purpose-aligned, but it needs Review because it can expose live vehicle data and issue remote vehicle commands without clear safety gates or warnings.

Install only if you trust this skill with a Tessie API key that can access vehicle telemetry and perform remote actions. Keep the key out of shared files and logs, review any agent command before it affects the vehicle, and avoid exposing command output that may include precise location or vehicle metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The audit document contains contradictory claims: it states that PII was scrubbed and that there is no PII leakage in errors, but later admits that full API responses are still echoed and may contain vehicle metadata. This is dangerous because it can mislead reviewers and operators into deploying a skill that still exposes sensitive telemetry or account-linked vehicle information through retained debug output.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The documentation expands the available command set to include additional high-impact remote vehicle controls such as unlock, sentry toggling, trunk activation, and window operations beyond the earlier described capability scope. In a skill that controls a physical vehicle, overstating or ambiguously documenting supported commands increases the chance that an agent or user will invoke dangerous actions without clear authorization boundaries, review, or safety expectations.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The skill presents a relatively limited set of capabilities and examples, but later declares a much broader remote-command surface. That inconsistency is risky because reviewers and users may underestimate what the skill can do, while an agent implementation may rely on the broader endpoint list to perform sensitive physical actions like unlocking the car or opening trunks.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The note acknowledges that full API responses may contain vehicle metadata, but it does not provide a strong user-facing warning and still frames the issue as acceptable for debugging. In a skill handling vehicle state and location-adjacent data, weak disclosure increases the chance that operators enable or retain unsafe logging without understanding the privacy impact.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill handles precise vehicle location and remote vehicle control but provides no warning that these are sensitive operations with privacy and physical-security implications. Access to live coordinates, lock state, climate, charging, and other controls can expose user movements or enable unauthorized interaction with a vehicle if triggered without informed consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The setup instructions tell users to place a long-lived API key in configuration or an environment variable without discussing secure storage, least privilege, rotation, or accidental disclosure risks. If exposed, the Tessie API key could grant broad access to vehicle data and remote-control functions through the linked Tesla account.

Missing User Warnings

Medium

Confidence: 77% confidence
Finding: The script prints precise vehicle location, speed, and shift state directly to stdout without any warning, masking, or confirmation. In an agent-skill context, stdout may be surfaced to logs, chat transcripts, or other users, which can expose highly sensitive real-time location data.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill exposes state-changing remote commands such as climate control, charging, and charge-limit changes with no confirmation, authorization gate, or safety warning. In an agent environment, natural-language misuse, prompt injection, or accidental invocation could cause unauthorized physical-world actions against the vehicle.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.