Security audit

agent-android

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it controls and reads an Android device over unauthenticated plaintext LAN HTTP, which deserves review before installation.

Install only if you are comfortable giving this CLI live control of an Android device. Use a test device or non-sensitive apps, keep the phone service off public or shared Wi-Fi, prefer an isolated trusted network or encrypted tunnel, and review the upstream package before installing because the uv dependency is not version-pinned here.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
' ``` 2. Publish and verify cryptographic hashes for the exact package artifact. 3. Prefer signed releases and document how users must verify the publisher signature. 4. Identify the canonical package registry and upstream repository explicitly. 5. Maintain a lockfile or equivalent reproducible dependency manifest where supported. 6. Review dependency updates before changing the pinned version. 7. Consider installing the CLI in a sandbox or least-privileged environment to limit the effect of a compromised package. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:15
Finding: Android UI Data and Control Operations Are Sent Over Plaintext HTTP
Content: View full analysis
:8080` The public path is local-first: - the phone hosts the lightweight HTTP service locally - the desktop connects directly to `http://:8080` - UI reads, taps, inputs, and screenshots stay on the phone and controlling machine ``` ```text Start the REPL with the user-provided device URL: - `agent-android --repl --url http://:8080` ``` From `references/smoke-flow.md`: ```text set url http://:8080 ``` ```bash curl http://:8080/health ``` ### Technical Analysis The documented workflow uses unencrypted HTTP for communication with a service that can expose UI trees, screenshots, installed applications, and interactive device-control operations. Plaintext HTTP does not provide transport confidentiality, integrity, or server identity verification. The instructions restrict use to a LAN and warn against exposing the service publicly. Those safeguards reduce exposure but do not protect against malicious or compromised systems on the same LAN. The documented command examples also do not show an authentication token, client certificate, or other request-authentication mechanism. An attacker capable of observing or modifying local network traffic may be able to read sensitive responses, alter commands or responses, replay requests, or impersonate the intended device service. The precise operations available without authentication depend on the external phone-side service, which is not included in the audited project. ### Attack Path 1. The user and Android device connect to a shared, compromised, or otherwise hostile LAN. 2. The user starts the CLI using the documented ...[truncated 1295 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file directs the user to launch an app, tap, enter text, and navigate on a connected Android device, which can change app or device state. The checklist does not include any warning to use a non-production/test device or to avoid sensitive apps/data while performing these actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.