Car Connect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:21 AM UTC
• Version: 3.0.0

Overview

The skill is meant to control cars, but it has unsafe targeting, broad bulk actions, precise location exposure, and fake success for some brands that users should review carefully.

Install only if you are comfortable reviewing and limiting its vehicle-control use. Avoid using Mercedes or Volkswagen commands, avoid --all with any action that changes vehicle state, verify the target vehicle manually before using --yes, and treat location output and ~/.car_connect contents as sensitive.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/car_connect.py:71

Finding

Unsafe Tesla vehicle selection can execute commands against the wrong vehicle

Content

View full analysis

Vulnerability Details

File Location: scripts/car_connect.py, lines 71-77
Vulnerability Type: Unsafe object selection and fail-open behavior
Risk Level: High

python

        # Filter by car name if given
        v = vehicles[0]
        if args.car:
            for veh in vehicles:
                if args.car.lower() in veh["display_name"].lower():
                    v = veh
                    break

Technical Analysis

The handler selects the first Tesla before processing --car. If the supplied name does not match any vehicle, the code does not report an error and leaves the first vehicle selected. The match is also substring-based and does not detect ambiguous matches.

All subsequent Tesla operations use v, including locking, unlocking, charging, opening the trunk, operating windows, activating climate controls, and sounding the horn. This violates fail-safe selection principles for safety-relevant remote controls.

Attack Path

1. The account contains multiple Tesla vehicles.
2. A user or automated agent invokes a consequential command with a misspelled, obsolete, or nonexistent --car value.
3. The loop finds no match.
4. v remains set to vehicles[0].
5. If --yes is present, the command executes against that unintended vehicle.

Impact Assessment

The issue does not grant access beyond the authenticated Tesla account, but it can direct existing vehicle-control privileges toward the wrong vehicle. Possible consequences include unlocking doors, opening a trunk, changing charging state, operating windows, or activating other remote functions on an unintended vehicle.

Remediation

View remediation

Remediation Suggestions

• Do not preselect the first vehicle when --car is supplied.
• Require an exact, unique match by VIN or normalized display name.
• Abort when no vehicle matches or when multiple vehicles match.
• For consequential actions, display the resolved vehicle name and VIN before execution.
• Consider requiring VIN-based selection when an account has multiple vehicles.
• Add tests for nonexistent, misspelled, partial, duplicate, and ambiguous vehicle names.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/car_connect.py:218

Finding

Kia commands ignore the requested vehicle and always select the first vehicle

Content

View full analysis

Vulnerability Details

File Location: scripts/car_connect.py, lines 218-220
Vulnerability Type: Missing authorization-target validation
Risk Level: High

python

    v = vm.vehicles[0] if vm.vehicles else None
    if not v:
        return {"error": "No Kia vehicles found"}

Technical Analysis

The Kia handler never evaluates args.car, even though the documented interface supports Kia commands using --car. It always assigns the first vehicle returned by the API to v.

Subsequent Kia operations, including lock, unlock, start_charging, and stop_charging, are performed against that first vehicle. The confirmation flag only confirms the action type; it does not validate the action target.

Attack Path

1. The Kia account contains multiple vehicles.
2. The caller invokes a command such as lock --brand kia --car "EV6" --yes.
3. The handler ignores "EV6" and selects vm.vehicles[0].
4. The lock operation executes against the first returned vehicle, regardless of the requested target.

Impact Assessment

Existing Kia account privileges can be applied to the wrong vehicle. This can cause unintended door locking or unlocking and unintended charging changes. The scope is limited to vehicles accessible through the supplied Kia credentials, but the physical-security consequences can be significant.

Remediation

View remediation

Remediation Suggestions

• Implement Kia vehicle resolution using args.car.
• Match a unique VIN or exact normalized vehicle name.
• Reject zero or multiple matches rather than falling back to the first vehicle.
• Require explicit selection when more than one Kia is present.
• Include the resolved vehicle identity in confirmation and success messages.
• Add multi-vehicle tests verifying that every state-changing method receives the intended vehicle.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/car_connect.py:531

Finding

The unrestricted --all option enables undocumented bulk vehicle operations

Content

View full analysis

Vulnerability Details

File Location: scripts/car_connect.py, lines 531-537
Vulnerability Type: Excessive operation scope
Risk Level: High

python

    if args.all:
        results = {}
        for brand in BRAND_HANDLERS:
            args.brand = brand
            result = BRAND_HANDLERS[brand](args)
            results[brand] = result
        _out(results, args.json)

Technical Analysis

The dispatcher applies --all to every command without checking whether the command is read-only. Documentation presents --all for listing and summaries, but the implementation also dispatches state-changing commands to every brand handler.

When combined with --yes, each compatible handler can execute the requested physical operation. A single confirmation therefore authorizes a potentially broad set of actions rather than one clearly identified vehicle operation. This exceeds the minimum scope necessary for ordinary per-vehicle control.

Attack Path

1. Multiple brand credentials are configured in the process environment.
2. A caller invokes a state-changing command with --all --yes, such as unlock --all --yes.
3. The dispatcher loops over every registered brand.
4. Each handler receives the same confirmed command.
5. Every implemented and compatible handler attempts the operation against its selected vehicle.

Impact Assessment

A single invocation can affect vehicles across multiple configured accounts and brands. Depending on the command, this can include locking or unlocking doors, changing charging state, activating climate controls, sounding horns, or starting and stopping engines. The operation remains bounded by configured automotive accounts, but its breadth is substantially greater than a normal single-target request.

Remediation

View remediation

Remediation Suggestions

• Permit --all only for an explicit allowlist of read-only commands, such as list and summary.
• Reject --all for every state-changing command before invoking any handler.
• Avoid mutating and reusing the same argument object across handlers.
• If bulk actions are intentionally added, require a separate explicit option and enumerate every target before confirmation.
• Require per-vehicle confirmation for physical-security operations such as unlock, trunk, windows, and engine control.
• Add dispatcher tests proving that consequential commands cannot enter the all-brands loop.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/car_connect.py:158

Finding

Tesla precise location is disclosed without the documented confirmation gate

Content

View full analysis

Vulnerability Details

File Location: scripts/car_connect.py, lines 158-163
Vulnerability Type: Sensitive location disclosure
Risk Level: High

python

        elif args.command == "location":
            ds = v.vehicle_state.get("drive_state", {})
            lat = ds.get("latitude")
            lon = ds.get("longitude")
            return {"brand": "tesla", "lat": lat, "lon": lon, "heading": ds.get("heading")}

The documentation states that location is approximate by default and precise only when --yes is supplied. The implementation does not inspect args.yes and always returns the raw latitude, longitude, and heading supplied by the vehicle API.

Technical Analysis

Exact vehicle coordinates are highly sensitive personal data. The missing gate causes the implementation to violate its declared privacy boundary. Output may also enter terminal histories, automation logs, or agent context. The --json option does not make the data privacy-safe because it serializes the same raw values.

Attack Path

1. Tesla credentials or an authenticated Tesla session are available.
2. A caller invokes location --brand tesla without --yes.
3. The vehicle drive-state data is loaded.
4. Raw latitude, longitude, and heading are returned directly.
5. The values may be captured by the caller, logs, or downstream automation.

Impact Assessment

The caller can obtain the precise location and heading of the selected vehicle without the consent step promised by the Skill. This can reveal a user's home, workplace, travel patterns, or current whereabouts. The vulnerability does not extend system privileges, but it exposes sensitive physical-location data within the authenticated account scope.

Remediation

View remediation

Remediation Suggestions

• Check args.yes before returning precise coordinates.
• Without confirmation, round coordinates to a documented coarse precision or return only a broad region.
• Omit heading and other movement-related details from approximate output.
• Clearly distinguish approximate and precise location fields.
• Warn that precise output may be recorded by terminals and automation systems.
• Add tests verifying that raw coordinates cannot appear without explicit confirmation.

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/car_connect.py:414

Finding

Mercedes and Volkswagen handlers spoof vehicle status and successful control operations

Content

View full analysis

Vulnerability Details

File Location: scripts/car_connect.py, lines 414-476
Vulnerability Type: Spoofed API behavior and fabricated success responses
Risk Level: High

python

# ---- MERCEDES (stub) ----
def _mercedes(args):
    email = os.environ.get("MERCEDES_EMAIL")
    password = os.environ.get("MERCEDES_PASSWORD")
    if not email or not password:
        return {"error": "Set MERCEDES_EMAIL and MERCEDES_PASSWORD env vars"}

    if args.command == "auth":
        _save_token("mercedes", {"email": email})
        return {"success": True, "brand": "mercedes", "info": "Mercedes Me auth setup needed - use Mercedes Me app to get tokens"}

    if args.command == "list":
        return {"brand": "mercedes", "cars": [{"id": "demo-vin", "name": "Mercedes EQS"}]}

    if args.command == "summary":
        return {"brand": "mercedes", "name": "Mercedes EQS", "charge": "85%", "range": "380 mi", "locked": True, "state": "online"}

    if args.command == "status":
        return {"brand": "mercedes", "name": "Mercedes EQS", "charge": "85%", "range": "380 mi"}

    if args.command == "lock":
        if not args.yes:
            return {"confirm": "lock --yes"}
        return {"success": True, "action": "locked"}

    if args.command == "charge":
        if args.subcommand == "status":
            return {"brand": "mercedes", "charge": 85, "range": 380}

    return {"error": f"Unknown command: {args.command}"}

BRAND_HANDLERS["mercedes"] = _mercedes

# ---- VOLKSWAGEN (stub) ----
def _volkswagen(args):
    email = os.environ.get("VW_EMAIL")
    password = os.environ.get("VW_PASSWORD")
    if not email or not password:
        return {"error": "Set VW_EMAIL and VW_PASSWORD env vars"}

    if args.command == "auth":
        _save_token("volkswagen", {"email": email})
        return {"success": True, "brand": "volkswagen", "info": "Volkswagen We Connect ID auth setup needed"}

    if
...[truncated 1993 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Mercedes and Volkswagen from the supported-brand list until real integrations exist.
• Replace stub results with explicit unsupported errors.
• Never return success for a remote operation unless the API accepted it and the result was verified.
• Clearly label mock implementations and prevent them from being enabled in production execution.
• Validate returned vehicle identity and state against authenticated API responses.
• Add integration tests that fail if handlers return fixed demonstration values or success without a network operation.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:75

Finding

Vehicle-control dependencies are installed without version or integrity pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75-79
Vulnerability Type: Unpinned security-sensitive dependencies
Risk Level: Medium

bash

pip install teslapy hyundai_kia_connect_api pymyhondaplus pytoyoda fordpass

Technical Analysis

The installation instructions resolve current package versions from the configured Python package index without exact version constraints or integrity hashes. These packages execute in a process containing automotive account identifiers and passwords and can issue remote vehicle commands.

This does not prove that any listed dependency is malicious. However, it creates a supply-chain trust gap: a compromised package account, malicious future release, dependency confusion condition, or incompatible update could introduce code that receives credential and vehicle-control access at runtime.

The pre-scan's flagged tesla.fetch_token() operation is consistent with the declared Tesla authentication feature and is not, by itself, evidence of credential exfiltration. Its security nevertheless depends on the installed teslapy package, making dependency integrity especially important.

Attack Path

1. A user follows the documented unpinned pip install command.
2. The package manager resolves whatever versions are current on the selected index.
3. A compromised or unexpectedly changed release is installed.
4. The package is imported by car_connect.py.
5. During login or command execution, package code runs with access to environment credentials, local user permissions, network access, and remote vehicle-control capabilities.

Impact Assessment

A compromised dependency could potentially read automotive credentials, authentication tokens, vehicle identifiers, and location data available to the process. It could also invoke vehicle-control APIs within the privileges of the authenticated accounts. Local impact would be bounded by the operating-system user runn ...[truncated 67 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct and transitive dependency to reviewed versions.
• Generate and maintain a lockfile.
• Require package hashes, for example through a hash-locked requirements file.
• Install dependencies in an isolated virtual environment with minimum operating-system privileges.
• Verify package names, publishers, release provenance, and vulnerability status before updates.
• Use a controlled package index or dependency mirror where practical.
• Review authentication-library changes before upgrading because these packages process credentials and control safety-relevant assets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The auth flow initiates remote authentication with third-party vehicle services and writes token-related account data to disk, but the user only sees a success message after completion. The code lacks an upfront warning that credentials will be used for network authentication and that local token files will be created.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code returns precise latitude and longitude for the vehicle, which is privacy-sensitive user data. There is no confirmation prompt, warning message, or other disclosure indicating that this command exposes live location information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Mercedes handler presents itself as supporting authentication and vehicle operations, but it only stores the email locally and returns hard-coded demo vehicle data and fake control success. In a car-control skill, misleading users into believing real auth and lock actions occurred is dangerous because it can cause unsafe assumptions about vehicle state and security.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Volkswagen handler similarly advertises auth, vehicle listing, status, fuel, and lock behavior but only returns static demo data and fake success. In this context, a user may rely on incorrect vehicle information or believe a security-relevant action like locking succeeded when nothing happened.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill reads sensitive environment variables such as TESLA_EMAIL and analogous credentials for other brands, but there is no explicit warning or disclosure that account credentials are being consumed from the environment. This is a sensitive operation under the audit criteria because it accesses user secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.