Security audit

Flipper Zero

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly a Flipper Zero control tool, but it exposes high-impact device, radio, deletion, and power actions without enforced safety checks.

Install only if you intend to give an agent broad control over your Flipper Zero. Treat delete, transmit, raw, GPIO power, reboot, screen capture, and navigation commands as sensitive; run them manually or after explicit review, avoid passing untrusted text as command arguments, and consider pinning dependencies before setup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/flipper_cli.py:245
Finding: Documented confirmation controls are not enforced for high-risk operations
Content: View full analysis
1 else '' risk = classify_risk('storage remove') result['risk'] = risk output = flipper.send_command(f'storage remove {path}') ``` USB SubGHz transmission paths in `scripts/flipper_cli.py:277-300`: ```python elif subcmd == 'tx': if len(args) < 5: result = {"status": "error", "message": "subghz tx requires "} else: device = args[5] if len(args) > 5 else '0' risk = classify_risk('subghz tx') result['risk'] = risk cmd = f'subghz tx {args[1]} {args[2]} {args[3]} {args[4]} {device}' output = flipper.send_command(cmd, wait=3) result['output'] = output elif subcmd == 'tx_from_file': if len(args) < 2: result = {"status": "error", "message": "subghz tx_from_file requires "} else: path = args[1] ...[truncated 3283 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/flipper_cli.py:115
Finding: CR/LF injection allows additional Flipper CLI commands through structured USB arguments
Content: View full analysis
1 else '/ext' output = flipper.send_command(f'storage list {path}') result['path'] = path ``` Deletion interpolation in `scripts/flipper_cli.py:245-249`: ```python elif subcmd == 'remove': path = args[1] if len(args) > 1 else '' risk = classify_risk('storage remove') result['risk'] = risk output = flipper.send_command(f'storage remove {path}') ``` SubGHz interpolation in `scripts/flipper_cli.py:281-299`: ```python else: device = args[5] if len(args) > 5 else '0' risk = classify_risk('subghz tx') result['risk'] = risk cmd = f'subghz tx {args[1]} {args[2]} {args[3]} {args[4]} {device}' output = flipper.send_command(cmd, wait=3) result['output'] = output elif subcmd == 'tx_from_file': if len(args) < 2: result = {"status": "error", "message": "subghz tx_from_file requires "} else: path = args[1] repeat = args[2] if len(args) > 2 else '1' device = args[3] if len(args) > 3 else '0' risk = classify_risk('subghz tx_from_file') result['risk'] = risk result['file ...[truncated 2785 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Unpinned runtime dependencies create a mutable software supply chain
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (24)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
| Feature | USB (`flipper_cli.py`) | BLE (`flipper_ble.py`) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
| Feature | USB (`flipper_cli.py`) | BLE (`flipper_ble.py`) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
| Feature | USB (`flipper_cli.py`) | BLE (`flipper_ble.py`) |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The skill exposes a destructive file-deletion command with an unconstrained path argument (storage remove /ext/old_file). Even though it is labeled high risk, the documentation presents a ready-to-use invocation that could be parameterized by an agent or user to delete arbitrary files on the device, causing data loss or erasing captured signals/configuration.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
flipper_cli.py storage read /ext/file.sub # Read file contents flipper_cli.py storage write /ext/path "data" # Write file flipper_cli.py storage mkdir /ext/new_dir # Create directory flipper_cli.py storage remove /ext/old_file # Delete (⚠️ HIGH RISK) flipper_cli.py storage info /ext # Storage stats flipper_cli.py subghz rx 433920000 0 10 # Listen 433.92MHz, internal, 10sec flipper_cli.py subghz rx 433920000 1 15 # Listen with external CC1101, 15sec

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The BLE interface similarly exposes a destructive deletion primitive with a user-controlled path (storage delete /ext/file). Because the skill enables direct machine-to-device control, an agent could misuse this parameter to remove arbitrary files wirelessly, making accidental or unauthorized destructive actions easier.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
flipper_ble.py storage read /ext/file.txt # Read file flipper_ble.py storage write /ext/path local.txt # Upload file flipper_ble.py storage mkdir /ext/new_dir # Create directory flipper_ble.py storage delete /ext/file # Delete (⚠️ HIGH RISK) flipper_ble.py storage info /ext # Storage stats flipper_ble.py storage md5 /ext/file # File checksum flipper_ble.py storage rename /ext/old /ext/new # Rename/move

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script exposes dangerous radio/emulation capabilities such as Sub-GHz transmit, IR transmit, NFC/RFID emulation, and raw command execution without any confirmation, policy gating, or allowlist. In an agent-controlled natural-language workflow, this materially increases the chance of unintended or unauthorized transmission actions with physical-world effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is described with very broad capability language ('full access' and 'complete control'), which can cause it to match generic user requests involving hardware, wireless, files, inputs, or device control. In this context, broad invocation is dangerous because the skill exposes high-risk capabilities such as SubGHz transmission, file deletion, GPIO power control, and reboot, increasing the chance of accidental or unsafe activation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/flipper_ble.py (reported line 321)May include surrounding context.
python
return {"status": "ok", "data": data.decode('utf-8', errors='replace'), "size": len(data)} async def storage_write(self, path, data): """Write data to a file on Flipper. Data can be bytes or str.""" if isinstance(data, str): data = data.encode('utf-8')

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/flipper_cli.py (reported line 13)May include surrounding context.
python
info - Device info (firmware, battery, storage) storage list <path> - List files/dirs storage read <path> - Read file contents storage write <path> <data> - Write data to file storage mkdir <path> - Create directory storage remove <path> - Delete file/dir storage copy <src> <dst> - Copy file

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring advertises led <r> <g> <b> - Set LED color, implying a three-channel RGB command. However, the implementation later accepts either led <channel> <value> for a single channel or led off, and its own inline comment says the firmware supports one channel at a time. This is an active contradiction between documentation and code behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: storage remove performs destructive deletion immediately with no confirmation or safety checks. In an autonomous or NL-driven agent context, a mistaken instruction, prompt injection, or argument confusion could irreversibly delete device files or payloads.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Power operations are executed directly, allowing immediate shutdown, reboot, or 5V toggling without warning or approval. In a remote-agent setting this can disrupt ongoing sessions, disable monitoring, interrupt workflows, or affect attached hardware unexpectedly.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
""" Flipper Zero BLE Screen & Input Control. Captures the Flipper's 128x64 monochrome display and provides D-pad input. Can render as PNG image or ASCII art. Usage:

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/flipper_screen.py (reported line 5)May include surrounding context.
python
""" Flipper Zero BLE Screen & Input Control. Captures the Flipper's 128x64 monochrome display and provides D-pad input. Can render as PNG image or ASCII art. Usage:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code connects to a Flipper device over BLE and later retrieves screen-frame data, which is a form of device data transmission. While the module docstring describes functionality, it does not explicitly warn users that the skill can remotely read the device screen contents, which may expose sensitive information shown on the device.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script can send button presses, navigate menus, and launch apps on the connected Flipper device. Although these actions are part of the tool's functionality, there is no explicit disclosure warning users that running these commands will remotely control the device and may trigger unintended actions on it.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module usage text states transmit <filename> - Transmit a saved .sub file, which implies the command will perform transmission. However, transmit_file() only launches the Saved menu, captures the file list, and returns a note telling the user to navigate manually and hold OK to transmit; it never selects the named file or initiates transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code persistently writes screenshots and ASCII captures of the device screen to predictable files under /tmp without clearly informing the user. In this skill context, those captures can contain sensitive RF activity, saved signal names, or other device state that may be readable by other local users, retained longer than expected, or collected by unrelated processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Read RAW mode stores repeated captures to /tmp without notice, creating local artifacts of potentially sensitive radio collection activity. Because this skill interacts with SubGHz tooling, the captured material may reveal nearby transmissions or operator behavior, making silent persistence more risky than in an ordinary screenshot utility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Frequency analyzer screenshots are saved locally without disclosure, leaving a record of nearby RF emissions and device observations. In a radio-analysis skill, such artifacts can be operationally sensitive and should not be silently persisted in world-accessible or predictable temporary locations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Browsing saved SubGHz signals writes screenshots of the file list to /tmp, which may expose sensitive filenames, captured-signal metadata, or other device contents to local observers or later forensic recovery. The skill context increases risk because saved signal names may directly describe gates, alarms, or other security-relevant systems.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The docstring explicitly says Navigate to a saved file and transmit it, and even documents a filename parameter, but the code does not use filename to find a file and does not send inputs to start transmission. Instead, it only opens the Saved menu and returns a note instructing manual follow-up steps.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The usage text documents subghz rx <freq> [device], but the implementation parses freq, optional device, and then an optional duration from args[3]. This means the actual accepted interface is broader than documented, and the documentation is inaccurate about how arguments are interpreted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The status command creates a local screenshot file without user-facing disclosure. While lower impact than the RF capture paths, it still silently persists device screen contents that may include sensitive operational state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.