phonebase

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

The skill controls a cloud phone as advertised, but it asks the agent to use broad control powers and follow other installed skill files without enough verification.

Install only if you intentionally want an agent to operate an Android cloud phone and you trust the pb CLI plus any enabled PhoneBase app skills. Review installed pb skills before use, avoid installing skills from unknown local paths or hubs, and be cautious with logged-in apps, APK installs, clipboard, file transfer, and shell actions on the cloud device.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

Before doing anything else, verify `pb` is installed:

pb --version

text

If the command is not found, ask the user to install it:

npm install -g phonebase-cli

text

Do not run the install command yourself — the user runs it.

Technical Analysis

The installation guidance uses an unpinned npm package name and performs a global installation. It does not specify a trusted registry, exact version, integrity digest, signature-verification procedure, or validated publisher identity.

Although the skill explicitly tells the agent not to execute the installation command, the user is still instructed to run it. npm package installation can execute package lifecycle scripts on the local host. Consequently, compromise of the package, its publisher account, or its distribution channel could turn the documented setup procedure into local code execution.

Attack Path

1. An attacker compromises the phonebase-cli publisher account, package release pipeline, or another relevant supply-chain component.
2. The attacker publishes a malicious version under the package name referenced by the skill.
3. A user without pb follows the documented command, which does not constrain the selected version or verify integrity.
4. npm downloads the malicious release and may execute its lifecycle scripts during global installation.
5. The payload executes locally with the permissions of the user running npm.

This path depends on compromise of the referenced package or its distribution chain; the audited file does not itself contain an executable payload.

Impact Assessment

Successful exploitation could execute arbitrary code on the user's local machine with the installing user's privileges. Potential effects include access to that user's ...[truncated 313 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed exact version rather than resolving the latest available release.
• Identify the official package registry and verified publisher explicitly.
• Publish and verify a cryptographic integrity digest or signed release artifact.
• Prefer a project-local or isolated installation over a global installation where practical.
• Disable lifecycle scripts during installation when they are not required, then document any necessary post-installation steps separately.
• Provide a trusted download and verification procedure and require re-verification when the pinned version changes.
• Warn users not to run the installation with elevated privileges.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:216

Finding

Unverified Runtime Delegation to Dynamically Installed Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 216–231 and 249–254
Vulnerability Type: T01: Skill Instruction Hijacking, T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

markdown

## App Skills — Check Before You Act

**Before operating any app** (Google Play, TikTok, Gmail, Instagram, WhatsApp, etc.), ALWAYS check if a dedicated skill exists:

pb skills list

text

If the target app has a matching skill with `[enabled]` status, read its guide **before** doing anything:

cat ~/.phonebase/skills//SKILL.md

text

App skills contain step-by-step automation flows, known UI patterns, and workarounds specific to that app. Following them is significantly more reliable than improvising with raw tap/swipe commands.

markdown

### Installing More Skills

pb skills install googleplay # install from skill hub by name pb skills install # install from local directory

text

Run `pb skills list` after installing to verify. Only use skills that show `[enabled]`.

Technical Analysis

The skill creates a runtime trust boundary in which instructions from other skill files are loaded and followed before application operations. Those skills may be installed from an unspecified skill hub or a local directory. An [enabled] status is treated as sufficient authorization, but the document does not require signature validation, source allowlisting, version pinning, integrity checks, publisher verification, or security review of the loaded instructions.

This means the effective agent instructions can change after the audited package has been reviewed. A compromised hub package or a maliciously modified file under ~/.phonebase/skills/ could inject directions that alter the agent's workflow. The risk is amplified by the capabilities documented elsewhere in the same file, including APK installation, remote shell execution, file transfer, brows ...[truncated 2438 chars]

Remediation

View remediation

Remediation Suggestions

• Load only app skills signed by an explicitly trusted publisher and verify signatures before reading or following them.
• Pin every external skill to a reviewed immutable version and verify its cryptographic digest.
• Define an allowlist of approved skill sources, names, versions, and publisher identities.
• Treat downloaded and locally discovered skill text as untrusted guidance rather than authoritative instructions.
• State explicitly that secondary skills cannot override the original user request, system constraints, credential-handling rules, or security policies.
• Require review or explicit approval before an external skill may authorize high-impact capabilities such as APK installation, shell execution, file transfer, account changes, or data disclosure.
• Protect the local skill directory against unauthorized modification and reject symlinks, unexpected ownership, or unsafe permissions.
• Record and display the source, version, signer, and integrity digest of each enabled skill.
• Separate skill discovery from installation; do not automatically install a missing skill merely because an application task references it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger description is extremely broad and instructs the agent to use this skill for many generic requests such as logging into apps, searching, or opening common services, even when the user does not mention a phone. This can cause the skill to be invoked in contexts where it is not appropriate, leading to unintended execution of powerful device-control actions and expanding the attack surface for prompt or workflow hijacking.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: phonebase
description: Control Android cloud phones via the `pb` CLI. Make sure to use this skill whenever the user mentions logging into apps, installing apps, browsing on a phone, opening an app (Twitter, Google Play, WeChat, Instagram, TikTok, WhatsApp, Telegram, etc.), searching on phone, checking what's on screen, taking screenshots, tapping buttons, typing text, swiping, or any task that involves an Android device. This skill applies even if the user doesn't say "phone" or "pb" — phrases like "help me log in to Twitter", "install WeChat", "open Google Play", "search for something", or "check the screen" all imply phone operation. Always prefer pb over desktop browsers or Playwright for mobile and app tasks.
---

# PhoneBase Cloud Phone Control

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly authorizes autonomous use of impactful commands such as pb install, pb skills install, pb shell, and pb push whenever they seem to serve the user's request, without requiring per-action confirmation. In practice, these operations can alter device state, install software, transfer files, or import additional instructions, making accidental or manipulated destructive actions more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to read ~/.phonebase/skills/<skill-name>/SKILL.md on the host, which expands behavior from remote phone control into host filesystem access. Even if the path is intended for app-specific skill guides, <skill-name> is derived from discovered content and can lead to unintended local file reads, skill-to-skill prompt injection, or disclosure of host-resident data outside the user’s request.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 89% confidence

Finding

The skill instructs the agent to enumerate installed skills and then read another skill's local SKILL.md before acting. This creates a compositional attack surface where one skill can influence another via local prompt content, enabling indirect prompt injection, unexpected privilege expansion, or execution flow changes originating from host-resident files rather than the user's request.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

**Example:** User says "search for WhatsApp on Google Play and install it"
1. Run `pb skills list` → see `googleplay [enabled]`
2. Read `~/.phonebase/skills/googleplay/SKILL.md`
3. Follow the skill's search-and-install flow

If no matching skill exists, fall back to the general Interaction Pattern above.

Static analysis

No suspicious patterns detected.