Ghost in the Droid

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent mobile automation integration, but it gives an agent broad real-device control and sensitive screen/clipboard/app authority without clear safety boundaries or user-confirmation guidance.

Install only if you trust the package and need agent-driven mobile automation. Use a dedicated virtual environment, avoid running it as root, connect only owned or test devices, and require explicit approval before screenshots, OCR, clipboard reads, credential entry, APK installation, app-data clearing, or batch/replay actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Executable Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–45
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

pip install ghost-in-the-droid

The installed package is subsequently registered as an MCP server in SKILL.md, lines 47–58:

json

{
  "mcpServers": {
    "ghost-in-the-droid": {
      "command": "python",
      "args": ["-m", "ghost_in_the_droid"]
    }
  }
}

bash

openclaw mcp add ghost-in-the-droid --command "python -m ghost_in_the_droid"

Technical Analysis

The installation command retrieves the package version currently selected by the package index without pinning an exact reviewed version, verifying artifact hashes, or using a committed dependency lock file. Python package installation may execute package-controlled build or installation logic. The installed module is then configured for later execution as an MCP server.

This creates a supply-chain exposure: if the publisher account, package release process, package index, or transitive dependency chain is compromised, a malicious package release could be installed despite the skill documentation itself remaining unchanged.

The MCP server's documented functions include screenshots, accessibility-tree and OCR capture, clipboard access, text entry, app control, APK installation, device enumeration, app-data clearing, and emulator management. Consequently, compromise of this dependency could expose both the host execution context and connected mobile devices.

Attack Path

1. An attacker compromises the package publisher, release pipeline, distribution account, or a relevant dependency.
2. The attacker publishes a malicious version that remains compatible with the unpinned package name.
3. A user follows the documented pip install ghost-in-the-droid instruction.
4. The package manager selects and installs the malicious release; package-controlled installation or build logic may execute in the ...[truncated 1250 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed release, for example ghost-in-the-droid==X.Y.Z.
2. Distribute a lock file or hash-checked requirements file and require installation with hash verification, such as pip install --require-hashes -r requirements.txt.
3. Verify package provenance and document the trusted package index, source repository, maintainer identity, release-signing process, and expected artifact hashes.
4. Review and lock transitive dependencies rather than constraining only the top-level package.
5. Install the MCP server in a dedicated virtual environment, container, or similarly isolated runtime under a non-privileged account.
6. Restrict filesystem and network access to the minimum required for mobile automation.
7. Expose only explicitly authorized devices and avoid running the server with root or administrator privileges.
8. Require explicit user authorization for sensitive operations, particularly clipboard reads, screenshots, APK installation, app-data clearing, and credential entry.
9. Monitor dependency updates and require security review before changing the pinned version or accepted hashes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill grants broad real-device control and access to sensitive user data, including screenshots, screen text, clipboard contents, app interactions, and APK installation, but it provides no safety guidance, consent requirements, or privacy boundaries. In an agent context, that omission is dangerous because an LLM could invoke these capabilities on a real personal or corporate device and expose credentials, messages, tokens, or other sensitive data without the user understanding the risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

bash

# Install ADB
sudo apt install android-tools-adb   # Linux
brew install android-platform-tools  # macOS

# Connect device (USB or TCP)

Static analysis

No suspicious patterns detected.