ClawHub
Back to skill

Security audit

Tesla Control via Tessie

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and disclosed, but it can remotely query and control a real Tesla without enough confirmation or safety guardrails.

Review this skill carefully before installing. Only use it with a Tessie token you control, avoid placing the token in broadly readable shell profiles, and require explicit confirmation before running actions that unlock the vehicle, open trunks, change charging, disclose location, or schedule updates.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-15
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash
pip install requests

Technical Analysis

The installation instructions retrieve requests and its transitive dependencies without specifying reviewed versions or cryptographic hashes. Consequently, the installed components can change after the Skill has been audited.

This behavior does not demonstrate malicious intent or dependency confusion by itself, and requests is a legitimate dependency for the declared functionality. However, an attacker who compromises a package release, a transitive dependency, the configured package index, or package-resolution infrastructure could cause users to install attacker-controlled content.

Attack Path

  1. An attacker compromises a future release of requests, one of its dependencies, or an index used by the victim's pip configuration.
  2. A user follows the documented pip install requests instruction.
  3. Pip resolves the unpinned dependency to the compromised artifact.
  4. Malicious installation or runtime code executes in the user's environment.
  5. The code inherits the privileges of the user running pip or executing the Skill and may access credentials available to that process, including TESSIE_API_KEY.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing or runtime user's privileges. Depending on the environment, this could expose local files, environment variables, the Tessie API key, Tesla vehicle telemetry, and remote vehicle-control authority. System-wide installation with elevated privileges would increase the potential scope.

Remediation
View remediation

Remediation Suggestions

  • Pin requests and all transitive dependencies to reviewed versions in a lock file.

  • Require hashes with pip install --require-hashes.

  • Install dependencies inside an isolated virtual environment with ordinary user privileges.

  • Use a trusted, explicitly configured package index.

  • Add automated dependency scanning and controlled update review.

  • Example:

    text
    requests==<reviewed-version> --hash=sha256:<verified-hash>
    bash
    python -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.txt

T09 · Insecure Skill Coding Practices

Note
Location
scripts/tessie.py:20
Finding

Network Requests Lack Explicit Timeouts

Content
View full analysis

Vulnerability Details

File Location: scripts/tessie.py:20-24; scripts/check-updates.py:29
Vulnerability Type: Unbounded network wait and availability weakness
Risk Level: Low

Vulnerable Code

From scripts/tessie.py:

python
if method == 'GET':
    response = requests.get(url, headers=headers)
elif method == 'POST':
    if body:
        response = requests.post(url, headers=headers, json=body)
    else:
        response = requests.post(url, headers=headers)

From scripts/check-updates.py:

python
response = requests.get('https://api.tessie.com/vehicles', headers=headers)

Technical Analysis

Python Requests does not impose a default request timeout. A stalled connection, non-responsive upstream service, network interception, or incomplete response can therefore block these processes indefinitely.

The requests use HTTPS and target only the documented api.tessie.com service, so the audit found no covert recipient or credential-exfiltration endpoint. Sending the Bearer token, VIN, and command parameters to Tessie is necessary for the declared functionality. The weakness is the absence of bounded network behavior rather than unauthorized transmission.

Attack Path

  1. The user runs a monitoring or vehicle-control action.
  2. Tessie, an intermediary, or the local network accepts the connection but delays or never completes the response.
  3. The process remains blocked because no connect or read timeout is configured.
  4. Repeated scheduled checks can accumulate blocked processes and consume local resources.

Impact Assessment

Exploitation primarily affects availability. It can prevent commands or update checks from completing and may consume process slots, memory, or scheduler capacity. This issue does not independently grant additional privileges or expose the API key.

Remediation
View remediation

Remediation Suggestions

  • Configure explicit connect and read timeouts for every request, for example:

    python
    timeout = (5, 30)
response = requests.get(url, headers=headers, timeout=timeout)

  • Apply the same timeout policy to POST requests and check-updates.py.

  • Handle requests.exceptions.Timeout separately and return a clear failure.

  • Add bounded retries with exponential backoff and jitter only for safe, idempotent operations.

  • Do not automatically retry state-changing vehicle commands unless command idempotency is guaranteed.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tessie.py:128
Finding

Safety-Relevant Vehicle Command Values Are Not Range-Validated

Content
View full analysis

Vulnerability Details

File Location: scripts/tessie.py:128-138, scripts/tessie.py:142-152, and scripts/tessie.py:177-182
Vulnerability Type: Insufficient validation of safety-relevant command parameters
Risk Level: Medium

Vulnerable Code

python
elif action == 'set_temperature':
    if not args.vin:
        print("Error: --vin required", file=sys.stderr)
        sys.exit(1)
    if not args.value:
        print("Error: --value required (temperature in Celsius)", file=sys.stderr)
        sys.exit(1)
    result = invoke_command(api_key, args.vin, 'set_temperature',
                           {'temperature': int(args.value)})
python
elif action == 'set_charge_limit':
    if not args.vin:
        print("Error: --vin required", file=sys.stderr)
        sys.exit(1)
    if not args.value:
        print("Error: --value required (charge limit 0-100)", file=sys.stderr)
        sys.exit(1)
    result = invoke_command(api_key, args.vin, 'set_charge_limit',
                           {'percent': int(args.value)})
python
elif action == 'schedule_update':
    if not args.vin:
        print("Error: --vin required", file=sys.stderr)
        sys.exit(1)
    seconds = int(args.value) if args.value else 0
    result = invoke_command(api_key, args.vin, 'command/schedule_software_update',
                           {'in_seconds': seconds})

Technical Analysis

The script converts user-supplied values to integers but does not enforce semantic limits. In particular, the documentation states that charge percentage must be between 0 and 100, yet the implementation accepts any integer. Temperature and software-update delay values are likewise unbounded.

The Tessie API may reject invalid values, but relying exclusively on remote validation is unsafe for a client that issues physical vehicle commands. If the upstream API coerces, truncates, or later accepts unexpe ...[truncated 1299 chars]

Remediation
View remediation

Remediation Suggestions

  • Parse parameters through dedicated validators before constructing requests.

  • Enforce the documented charge-limit range of 0 through 100.

  • Enforce Tessie's documented supported climate-temperature range.

  • Require software-update delays to be non-negative and impose a reasonable maximum.

  • Reject malformed and out-of-range inputs locally with actionable error messages.

  • Consider argparse type validators, for example:

    python
    def bounded_int(minimum, maximum):
    def parse(value):
        parsed = int(value)
        if not minimum <= parsed <= maximum:
            raise argparse.ArgumentTypeError(
                f"value must be between {minimum} and {maximum}"
            )
        return parsed
    return parse

  • For high-impact commands such as unlocking, opening trunks, or scheduling an immediate update, require explicit user confirmation when used interactively.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Tainted flow: 'headers' from os.environ.get (line 26, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check-updates.py (reported line 30)May include surrounding context.

python
try:
        # Get vehicle data
        response = requests.get('https://api.tessie.com/vehicles', headers=headers)
        response.raise_for_status()
        data = response.json()

Tainted flow: 'headers' from os.environ.get (line 66, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tessie.py (reported line 24)May include surrounding context.

python
"""Make HTTP request and return JSON response"""
    try:
        if method == 'GET':
            response = requests.get(url, headers=headers)
        elif method == 'POST':
            if body:
                response = requests.post(url, headers=headers, json=body)

Tainted flow: 'headers' from os.environ.get (line 66, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tessie.py (reported line 27)May include surrounding context.

python
response = requests.get(url, headers=headers)
        elif method == 'POST':
            if body:
                response = requests.post(url, headers=headers, json=body)
            else:
                response = requests.post(url, headers=headers)
        else:

Tainted flow: 'headers' from os.environ.get (line 66, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tessie.py (reported line 29)May include surrounding context.

python
if body:
                response = requests.post(url, headers=headers, json=body)
            else:
                response = requests.post(url, headers=headers)
        else:
            raise ValueError(f"Unsupported HTTP method: {method}")

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-updates.py (reported line 11)May include surrounding context.

python
def get_api_key():
    """Get API key from environment"""
    api_key = os.environ.get('TESSIE_API_KEY')
    if not api_key:
        print("Error: TESSIE_API_KEY environment variable not set", file=sys.stderr)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tessie.py (reported line 12)May include surrounding context.

python
def get_api_key():
    """Get API key from environment"""
    api_key = os.environ.get('TESSIE_API_KEY')
    if not api_key:
        print("Error: TESSIE_API_KEY environment variable not set", file=sys.stderr)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill performs networked vehicle-control operations and depends on a sensitive environment variable, but it declares no explicit tool scope or permission boundaries. This increases the chance that an agent can invoke network access and read secrets without clear confinement, which is especially risky for a skill capable of issuing real-world commands to a vehicle.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use the skill for 'any other Tesla vehicle command,' which is an overly broad invocation trigger for a high-impact control surface. This can cause the agent to select the skill in ambiguous situations and execute sensitive actions like unlock, open trunk, or start climate when the user did not clearly intend direct vehicle control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation enumerates sensitive physical-world actions—unlocking doors, opening trunks, altering charging, changing climate, honking, flashing, and scheduling updates—without prominent warnings, authorization checks, or confirmation guidance. In this context, misuse could affect vehicle security, privacy, availability, or safety, especially because location and remote-control features are combined in one skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This reference documents powerful vehicle control commands such as unlock, open trunks, vent windows, and software/charging actions without any cautionary guidance, confirmation requirements, or indication that these actions can affect physical security and safety. In the context of an agent skill that may translate user requests into real-world vehicle commands, omission of safety warnings increases the risk of accidental or socially engineered misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/check-updates.py (reported line 30)May include surrounding context.

python
try:
        # Get vehicle data
        response = requests.get('https://api.tessie.com/vehicles', headers=headers)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tessie.py (reported line 43)May include surrounding context.

python
try:
        # Get vehicle data
        response = requests.get('https://api.tessie.com/vehicles', headers=headers)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tessie.py (reported line 49)May include surrounding context.

python
try:
        # Get vehicle data
        response = requests.get('https://api.tessie.com/vehicles', headers=headers)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tessie.py (reported line 55)May include surrounding context.

python
try:
        # Get vehicle data
        response = requests.get('https://api.tessie.com/vehicles', headers=headers)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tessie.py (reported line 61)May include surrounding context.

python
try:
        # Get vehicle data
        response = requests.get('https://api.tessie.com/vehicles', headers=headers)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tessie.py (reported line 27)May include surrounding context.

python
response = requests.get(url, headers=headers)
        elif method == 'POST':
            if body:
                response = requests.post(url, headers=headers, json=body)
            else:
                response = requests.post(url, headers=headers)
        else:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Vehicle location is highly sensitive physical-world telemetry that can reveal home, work, and real-time presence patterns. Returning it directly without any privacy notice, consent check, or minimization is risky, particularly in an agent setting where the requester may not be the vehicle owner or may have induced the agent to disclose it.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This generic command dispatcher sends arbitrary state-changing vehicle commands to the external API based on runtime input. In the context of an agent skill controlling a real car, that creates a dangerous execution surface for unauthorized or prompt-induced physical actions unless strong confirmation and authorization controls are added.

Content

Scanner excerpt · scripts/tessie.py (reported line 70)May include surrounding context.

python
'Authorization': f'Bearer {api_key}',
        'Content-Type': 'application/json'
    }
    url = f'https://api.tessie.com/{vin}/{command}'
    return make_request('POST', url, headers, body)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script exposes high-impact real-world vehicle actions such as unlock, trunk opening, climate control, charging changes, and software update scheduling without any confirmation, authorization gating, or safety interlocks. In an agent-skill context, this increases the risk of accidental, coerced, or prompt-injected execution leading to unauthorized physical-world effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script reads the TESSIE_API_KEY credential from the environment to authorize remote vehicle access, but it provides no user-facing notice that a sensitive token is required and will be used to control or query the vehicle. This matters because the credential enables access to highly sensitive vehicle functions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.