ClawHub
Back to skill

Security audit

DroneMobile

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims, but it can send real vehicle commands and has weak safeguards around confirmation and vehicle selection.

Install only if you are comfortable giving OpenClaw your DroneMobile account credentials and allowing it to control your vehicle. Use a specific DRONEMOBILE_DEVICE_KEY, verify the target vehicle before any command, and consider changing the script to fail closed instead of using the first vehicle when the configured key is missing or wrong.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill requires sensitive environment credentials and can issue physical-world vehicle control commands, but it does not declare corresponding permissions. This creates a trust and review gap: users or the hosting platform may not realize the skill can access secrets and perform high-impact actions like unlock, trunk release, or engine start.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill description advertises remote start, unlock, trunk open, and engine stop operations without an explicit warning that these actions affect physical security and vehicle state. In context, this is especially dangerous because mistaken invocation, prompt abuse, or unauthorized use could unlock a vehicle, expose contents, or change engine state in the real world.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.