ClawHub
Back to skill

Security audit

phonebase

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent cloud-phone control skill, but it gives the agent broad Android control and can activate for ambiguous app/login/search requests without enough user confirmation.

Install only if you intentionally want an agent to operate a cloud Android phone. Verify the phonebase-cli npm package before installing, authenticate directly without sharing credentials, and require explicit approval for app installs, uninstalls, file transfers, shell/API commands, logins, and account-changing actions.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to read `~/.phonebase/skills/<skill-name>/SKILL.md` from the host filesystem, which crosses the stated remote-phone-only control boundary and grants local file read capability based on dynamically selected names. Even if intended for legitimate skill discovery, this pattern can expose local files or sensitive host data if path handling is weak or if installed skills are untrusted/symlinked.

Vague Triggers

High
Confidence
96% confidence
Finding
The trigger criteria are extremely broad and instruct the agent to use this skill for many ordinary requests, including cases where the user never explicitly requested phone/device control. This can cause inappropriate routing into a powerful automation skill, leading to unintended app interaction, browsing, installation, or account-related actions on connected devices.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly states that commands like `pb install`, `pb skills install`, `pb shell`, and `pb push` are safe to run autonomously when they serve the user's request, without requiring confirmation for data-impacting operations. This normalizes destructive or state-changing behavior and increases the chance of unwanted installs, modifications, or other irreversible actions on the remote device.

Static analysis

No suspicious patterns detected.