ClawHub
Back to skill

Security audit

蓝牙设备监控

Security checks for vulnerabilities and agentic risk

Overview

This is a small macOS Bluetooth helper whose device listing and control behavior is mostly disclosed, with some usability and terminal-output safety caveats.

Install only if you are comfortable with a local macOS helper that can connect, disconnect, and turn Bluetooth on or off when explicitly invoked. Be cautious using the power-off command if you rely on Bluetooth input devices, and treat displayed device names/status as potentially spoofable until the terminal-output and grep handling issues are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
bluetooth-monitor.sh:110
Finding

Terminal Escape Sequence Injection Through Bluetooth Device Names

Content
View full analysis

Vulnerability Details

File Location: bluetooth-monitor.sh, lines 110, 146, and 151
Vulnerability Type: Unsafe rendering of attacker-controlled terminal output
Risk Level: Medium

Vulnerable Code

bash
echo -e "🔗 ${GREEN}$name${NC}"

The same unsafe output pattern is used for paired devices:

bash
if [ -n "$connected" ]; then
    echo -e "🔗 ${GREEN}$name${NC} (已连接 / Connected)"
    # 获取电量 / Get battery level
    battery=$(get_battery_level "$name")
    show_battery_bar "$battery" "$name"
else
    echo -e "🔗 $name (未连接 / Disconnected)"
fi

Technical Analysis

The name variable is extracted from Bluetooth device metadata returned by blueutil. Bluetooth device names are not inherently trusted because they can be selected by the owner of a nearby or previously paired device.

The script embeds this value in an echo -e call. The -e option enables interpretation of backslash escapes. Consequently, a name containing supported escape notation can produce terminal control characters instead of being displayed literally.

Depending on the terminal emulator and its configuration, terminal control sequences can:

  • Clear or overwrite displayed content.
  • Move the cursor and create misleading output.
  • Change terminal titles or colors.
  • Produce fake success, warning, or command-prompt messages.
  • Invoke terminal-specific OSC functionality, potentially including clipboard manipulation.

This is terminal-output injection rather than shell command injection. The device name is not passed to eval or executed as a command.

Attack Path

  1. An attacker configures a Bluetooth device with a name containing backslash escape notation understood by echo -e.
  2. The maliciously named device becomes visible as a connected or paired device on the target Mac.
  3. The user executes bluetooth-monitor connected or bluetooth-monitor paired.
  4. blueutil returns the att ...[truncated 769 chars]
Remediation
View remediation

Remediation Suggestions

Do not pass untrusted device metadata to echo -e. Use printf with a constant format string and place color codes and untrusted values in separate arguments:

bash
printf '🔗 %b%s%b\n' "$GREEN" "$name" "$NC"
printf '🔗 %b%s%b (Connected)\n' "$GREEN" "$name" "$NC"
printf '🔗 %s (Disconnected)\n' "$name"

As defense in depth, remove terminal control characters from device names before rendering them:

bash
safe_name=$(printf '%s' "$name" | LC_ALL=C tr -d '\000-\010\013\014\016-\037\177')

Use safe_name only for display. Preserve the original device name separately if it is required for exact data lookup. Apply the same safe-output rule to every value obtained from Bluetooth metadata.

T09 · Insecure Skill Coding Practices

Note
Location
bluetooth-monitor.sh:31
Finding

Bluetooth Device Names Used as Uncontrolled grep Patterns

Content
View full analysis

Vulnerability Details

File Location: bluetooth-monitor.sh, lines 31–50
Vulnerability Type: Regular-expression and command-option injection into grep
Risk Level: Low

Vulnerable Code

bash
# 获取蓝牙电量 / Get Bluetooth battery level
get_battery_level() {
    local name="$1"
    local battery=$(/usr/sbin/system_profiler SPBluetoothDataType 2>/dev/null | \
        grep -A10 "$name" | grep "Battery Level" | sed 's/.*: //' | tr -d '%')
    if [ -n "$battery" ]; then
        echo "$battery"
    else
        echo "N/A"
    fi
}

# 获取设备类型 / Get device type
get_device_type() {
    local name="$1"
    local device_type=$(/usr/sbin/system_profiler SPBluetoothDataType 2>/dev/null | \
        grep -A10 "$name" | grep "Minor Type" | sed 's/.*: //')
    if [ -n "$device_type" ]; then
        echo "$device_type"
    else
        echo "Unknown"
    fi
}

Technical Analysis

The device-controlled name value is passed to grep as a regular-expression pattern:

bash
grep -A10 "$name"

Shell quoting prevents shell metacharacter expansion, but it does not make the value a literal grep pattern. Regular-expression characters in a Bluetooth name can therefore change matching behavior. A name beginning with a hyphen may also be interpreted as an additional grep option because no -- option terminator is present.

A crafted pattern can match unrelated sections of system_profiler output. The subsequent context search may then attribute another device's battery level or type to the maliciously named device. Invalid patterns or injected options may also cause grep to fail. Because the script enables set -e, some failure conditions can terminate the operation unexpectedly.

This issue does not create shell command execution because the variable is quoted and is not evaluated by a shell execution primitive.

Attack Path

  1. An attacker gives a Bluetooth device a nam ...[truncated 961 chars]
Remediation
View remediation

Remediation Suggestions

Treat the device name as a fixed string and terminate option parsing explicitly:

bash
local battery=$(/usr/sbin/system_profiler SPBluetoothDataType 2>/dev/null | \
    grep -F -A10 -- "$name" | grep -F "Battery Level" | sed 's/.*: //' | tr -d '%')

local device_type=$(/usr/sbin/system_profiler SPBluetoothDataType 2>/dev/null | \
    grep -F -A10 -- "$name" | grep -F "Minor Type" | sed 's/.*: //')

For stronger correctness, avoid context-based parsing by device name. Parse structured output from system_profiler, if available, and correlate records using a unique Bluetooth address rather than a non-unique, attacker-controlled display name.

Also handle failed lookups explicitly instead of relying on global set -e, so malformed or unmatched metadata cannot terminate the entire monitoring operation.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description and documented behavior are inconsistent: it claims pairing support that is not implemented, while also exposing Bluetooth power control that is not clearly reflected in the declared purpose. This can mislead users or higher-level agents into invoking system-state-changing actions they did not expect, increasing the chance of unsafe or disruptive execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Documenting a Bluetooth power-off capability without a prominent warning understates that the command changes system connectivity state and may disconnect keyboards, mice, headphones, or other active devices. In an agent-driven context, this creates a safety risk because a user may interpret the skill as read-only monitoring while it can perform disruptive actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata advertises monitoring plus connect/disconnect operations, but the script also includes power on/off, which changes a host-wide system setting. This is a scope mismatch that can surprise users or higher-level agents into performing a more disruptive action than the declared capability, such as disabling all Bluetooth peripherals.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Several user-facing messages present Chinese first and in some cases only Chinese is used for the primary output text, such as the installation error and command examples. The file does not provide any mechanism for the user to select language or locale, which can conflict with policies against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest states that the skill supports pairing, connecting, and disconnecting Bluetooth devices. The script implements listing connected/paired devices, connecting, disconnecting, and power control, but there is no command that performs Bluetooth pairing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.