ClawHub
Back to skill

Security audit

Android Remote Control

Security checks for vulnerabilities and agentic risk

Overview

This skill is an Android remote-control helper that is mostly disclosed, but it can manipulate a connected phone without clear safety gates and overstates some capabilities.

Install only if you intentionally want an agent to control a USB-debug-enabled Android device. Review each requested tap or app launch carefully, avoid using it with sensitive apps unless you are watching the device, and consider adding confirmations or an allowlist before unattended use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description promises a substantive Android remote-control skill with device management and automation features. The actual code chunk does not implement any of those behaviors; it merely prints a static example message and includes comments indicating it is a placeholder. This is a material mismatch in primary purpose and implemented capabilities.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The code generally aligns with the core theme of Android remote interaction via uiautomator2 and ADB, including screenshot capture and basic app control. However, the declared description claims additional capabilities that are not present in the supplied code: there is no app install/uninstall logic, no explicit debugging features beyond device connection, and no true live screen viewing functionality—only one-off screenshots. This is a description-to-behavior mismatch due to materially overstated capabilities, even though the implemented functions are related to the stated domain.

Ae2

Medium
Category
analysis-evasion
Confidence
90% confidence
Finding
Artifact content does not match its filename extension

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script exposes remote control actions that can start apps and simulate touch input immediately from command-line arguments, with no confirmation, authorization check, or interactive safety gate. In the context of an Android remote-control skill, this is particularly sensitive because these actions can manipulate a connected personal device and trigger unintended or unauthorized operations if the skill is invoked by another component or user unexpectedly.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The code unconditionally appends a hard-coded ADB directory to PATH, overriding normal environment selection and silently trusting a specific local installation. This is risky because it reduces transparency and can cause the script to use an unexpected or stale ADB binary, which is especially problematic for a tool that controls connected devices.

Static analysis

No suspicious patterns detected.