ClawHub
Back to skill

Security audit

Tmp.NMfGvcHqi4

Security checks across malware telemetry and agentic risk

Overview

This skill is not deceptive, but it gives agents direct access to precise vehicle location and remote vehicle controls while handling reusable credentials in risky local files.

Install only if you are comfortable with an agent using Kia account credentials to read vehicle data and send remote commands. Treat the rmtoken like a password, avoid running these examples on shared machines, replace predictable /tmp header files with private temporary files, and require explicit confirmation before retrieving location, unlocking the car, changing climate, or changing charging settings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The location examples explicitly retrieve precise vehicle coordinates but do not warn that this exposes highly sensitive real-world location data. In a skill intended for agent use, omission of a warning increases the chance the agent will fetch or display location data without user awareness, enabling privacy harm, stalking, or unintended disclosure in logs or transcripts.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
These examples perform real remote actions such as lock, unlock, climate start/stop, and EV charging changes, but the documentation does not prominently warn that they alter the vehicle's physical state. In an agent context, that omission is dangerous because it can normalize direct execution of safety-relevant commands without confirmation, increasing the risk of unauthorized or accidental actuation.

Session Persistence

Medium
Category
Rogue Agent
Content
with `chmod 600`. It is a credential: it re-authenticates the account without a
password prompt.

> Do **not** write it to `~/.kiaaccess-mcp/session.json`. That path belongs to the
> `kiaaccess-mcp` server, whose store is keyed by `accountId` with a different
> schema — overwriting it corrupts the server's session and forces it back
> through MFA.
Confidence
83% confidence
Finding
write it to `~/.kiaaccess-mcp

Tool Parameter Abuse

High
Category
Tool Misuse
Content
"otpkey: $OTPKEY" "xid: $XID" | jq '.status'

SID=$(grep -i '^sid:'     /tmp/kia_hdrs | tr -d '\r' | cut -d' ' -f2)
RMTOKEN=$(grep -i '^rmtoken:' /tmp/kia_hdrs | tr -d '\r' | cut -d' ' -f2)

mkdir -p "$(dirname "$KIA_SESSION")" && chmod 700 "$(dirname "$KIA_SESSION")"
jq -nc --arg r "$RMTOKEN" --arg d "$KIA_DEVICE" '{rmtoken:$r,deviceId:$d}' \
Confidence
84% confidence
Finding
RMTOKEN=$(grep -i '^rmtoken:' /tmp/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/requests.md:44