Aika Gps

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:06 AM UTC
• Version: 1.0.0

Overview

This GPS tracking skill appears purpose-built for technician dispatch, but it packages sensitive live-location access with hardcoded credentials and insecure HTTP fallback behavior.

Review this before installing in any real environment. Rotate the packaged AIKA credentials, remove plaintext secrets and device identifiers from the skill package, disable all HTTP endpoints, and add explicit authorization/privacy controls before allowing users to query technician locations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/aika_config.json:58
• Finding: Production Credentials and Sensitive Tracking Identifiers Stored in Plaintext## Vulnerability Details **File Location**: `references/aika_config.json:14-18, 58-65` **Vulnerability Type**: Hard-coded credentials and sensitive identifiers **Risk Level**: High ### Vulnerable Code ```json "7028888047": { "device_id": "OBD-88047", "device_number": "7028888047", "device_name": "รถช่าง / ไทรทัน", "iccid": "896603252520506488678F", ``` ```json "authentication": { "username": "7028888047", "password": "123456", "session_timeout": 3600, "auto_refresh": true, "demo_mode": false, "ready_for_production": true, "credentials_status": "complete" }, ``` The credentials are consumed when the application authenticates in `scripts/aika_gps.py:52-55`: ```python auth_data = { 'username': self.config['authentication']['username'], 'password': self.config['authentication']['password'] } ``` ### Technical Analysis An apparent production username and password are committed directly in the project configuration. The same configuration includes a GPS device number, device identifier, and SIM ICCID. The flags `demo_mode: false`, `ready_for_production: true`, and `credentials_status: complete` indicate that the values are intended for operational use rather than being clearly marked examples. Secrets committed to a project can be recovered from distributed copies, backups, build artifacts, and repository history even after deletion from the latest revision. The application automatically reads these values and submits them to the configured AIKA login endpoint. ### Attack Path 1. An attacker obtains the Skill package, repository contents, backup, or derived deployment artifact. 2. The attacker reads the username, password, device number, device identifier, and ICCID from `references/aika_config.json`. 3. The attacker submits the exposed credentials to the configured AIKA service. 4. If the credentials remain valid and the upstream service permits access, t ...[truncated 743 chars]
• Remediation: ## Remediation Suggestions 1. Immediately revoke and rotate the exposed AIKA password and invalidate existing authenticated sessions. 2. Verify whether the credentials appeared in repository history, logs, packages, backups, or deployment artifacts and treat all such copies as compromised. 3. Remove passwords, session tokens, ICCIDs, and production device identifiers from version-controlled configuration. 4. Load authentication data from a protected secret manager or environment variables at runtime. 5. Commit only a redacted example configuration containing placeholders. 6. Restrict configuration-file permissions to the service account that requires access. 7. Use a dedicated least-privilege AIKA account that can access only the devices required by this integration. 8. Add automated secret scanning to pre-commit checks and continuous integration. 9. Avoid returning full device numbers or other unnecessary identifiers in command output.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/aika_gps.py:48
• Finding: Authentication Credentials Can Be Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `references/aika_config.json:2-9`; `scripts/aika_gps.py:48-65` **Vulnerability Type**: Insecure transport of authentication credentials **Risk Level**: High ### Vulnerable Code `references/aika_config.json:2-9` defines a plaintext fallback endpoint: ```json "aika_settings": { "server_url": "https://www.aika168.com", "alternative_url": "http://www.aika168.com", "mobile_url": "https://m.aika168.com", "login_endpoint": "/login", "gps_endpoint": "/api/gps", "timeout": 30, "mobile_optimized": true }, ``` `scripts/aika_gps.py:48-65` sends the same credentials to that endpoint after a non-success response from the primary server: ```python login_url = self.config['aika_settings']['server_url'] + self.config['aika_settings']['login_endpoint'] auth_data = { 'username': self.config['authentication']['username'], 'password': self.config['authentication']['password'] } response = self.session.post(login_url, data=auth_data) if response.status_code == 200: self.last_login = datetime.now() return True else: # Try alternative URL login_url = self.config['aika_settings']['alternative_url'] + "/login" response = self.session.post(login_url, data=auth_data) ``` ### Technical Analysis When the HTTPS login returns any status other than HTTP 200, the integration posts the username and password to an `http://` URL. HTTP does not provide confidentiality, server authentication, or transport integrity. A network-positioned attacker can observe the request body, modify traffic, or impersonate the fallback server. This implementation also contradicts the statement in `SKILL.md` that the Skill uses HTTPS only. The fallback is activated based solely on the primary endpoint's status code. It is therefore not limited to a carefully validated service outage and may occur during ordinary authentication errors or server-side fai ...[truncated 1123 chars]
• Remediation: ## Remediation Suggestions 1. Remove the plaintext HTTP fallback entirely. 2. Change every configured service URL to an authenticated HTTPS endpoint. 3. Validate configuration during startup and reject any URL whose scheme is not `https`. 4. Do not retry authentication against a less secure transport after an error. 5. Keep TLS certificate verification enabled and use a current trusted certificate store. 6. Apply explicit connection and read timeouts to each request rather than relying on an attribute assigned to the session object. 7. Distinguish authentication failures from temporary server errors and use bounded retries only against the same trusted HTTPS origin. 8. Rotate the exposed credentials because they may already have traversed the HTTP fallback. 9. Add tests that fail if any authentication or tracking endpoint uses plaintext HTTP.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29
• Finding: Third-Party Dependencies Are Installed without Version or Integrity Pinning## Vulnerability Details **File Location**: `SKILL.md:29-32` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```text 1. ใส่ Device ID ในไฟล์ `references/aika_config.json` 2. ติดตั้ง dependencies: `pip install requests beautifulsoup4` 3. Restart OpenClaw gateway ``` ### Technical Analysis The installation instructions resolve `requests` and `beautifulsoup4` without fixed versions, hashes, or a lock file. Consequently, separate installations may retrieve different package versions and transitive dependency sets. This is not evidence that either named package is currently malicious. The weakness is that the project does not constrain installation to reviewed artifacts. A future compromised release, vulnerable release, unexpected compatibility change, or compromised package-distribution path could affect deployments without any change to the Skill itself. ### Attack Path 1. An operator follows the documented installation command. 2. `pip` resolves the latest available versions of the named packages and their transitive dependencies. 3. If a resolved release or distribution source has been compromised, malicious installation or runtime code is downloaded. 4. Package code executes with the privileges of the account performing installation or running the Skill. 5. That code could access the same files, credentials, network connectivity, and GPS data available to the Skill process. This path is conditional on an upstream package or distribution compromise; the audit found no evidence that the currently named packages are themselves malicious. ### Impact Assessment The potential privilege level is that of the user or service account installing and running the dependencies. Accessible scope may include application secrets, AIKA credentials, tracking data, local files available to that account, and outbound network access. Installation performed with administrative priv ...[truncated 42 chars]
• Remediation: ## Remediation Suggestions 1. Add a reviewed dependency manifest or lock file with exact versions. 2. Pin transitive dependencies as well as direct dependencies. 3. Require cryptographic hashes, for example through a hash-locked requirements file and `pip install --require-hashes`. 4. Install packages only from an explicitly configured trusted package index. 5. Run dependency vulnerability and provenance checks in continuous integration. 6. Use a dedicated virtual environment and avoid installing packages with administrative privileges. 7. Establish a controlled update process that reviews and tests dependency changes before deployment. 8. Update `SKILL.md` so installation uses the locked dependency file rather than unconstrained package names.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly enables real-time technician location lookup, nearest-technician search, and geofencing, but it does not warn users that it exposes sensitive live location data. This increases the risk of misuse, overcollection, or unauthorized tracking because operators may invoke the skill without clear privacy, consent, or access-control expectations.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: This JSON contains multiple natural-language values in Thai and a fixed Bangkok timezone, such as driver, vehicle, and skill labels, indicating a locale-specific configuration. Because the file does not provide any user-selectable language or locale option, it appears to enforce a specific locale without documented opt-in.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This code performs authenticated HTTP requests to external AIKA endpoints using device identifiers and credentials, then later returns precise latitude/longitude and related data to the user. While the script's purpose is GPS lookup, there is no explicit disclosure in comments, docstrings, or usage text that location queries send data to remote services and output sensitive location information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill handles technician GPS locations and customer addresses, which are sensitive location data, but this file contains no consent, disclosure, access-control, or minimization logic. In an agent skill context, exposing precise employee location or processing user addresses without clear authorization can create privacy and safety risks, including tracking and misuse of movements.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""รันคำสั่ง AIKA GPS script"""
        try:
            cmd = ['python', self.aika_script] + cmd_args
            result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8')
            
            if result.returncode == 0:
                return json.loads(result.stdout)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The skill instructions, commands, and examples are presented exclusively in Thai, which can impose a language/locale constraint on users. There is no statement that the skill is Thai-only, region-specific, or that users may choose another language.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: This JSON uses Thai-only natural-language identifiers and values for technician names, vehicles, and skill labels, while also mixing in an English alternative server entry. There is no indication that the skill is intentionally region-locked or that users can choose a language/locale, which may conflict with a policy requiring language choice or explicit locale justification.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: Natural-language strings in the module docstring and method docstrings are written in Thai, and the script does not offer any locale selection or opt-in. This can violate language/locale policy when a skill forces a specific language without giving users a choice.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file's natural-language descriptions and user-visible error messages are written in Thai, and there is no indication that users can choose another language or locale. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless clearly justified and documented.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The integration delegates work to another script via subprocess.run, which is a safety-relevant operation for code files. Although the docstring says it runs the AIKA GPS script, there is no visible user-facing disclosure or warning that the skill will execute an external Python process.

Static analysis

No suspicious patterns detected.