Chameleon Ultra Cli

• Outcome: Review
• Latest audit: Jul 25, 2026 · 3:48 PM UTC
• Version: 0.1.0

Overview

This skill openly automates a Chameleon Ultra device for card reading, cloning, emulation, and MIFARE key-recovery workflows, which is powerful dual-use behavior that needs careful review before installation.

Install only if you understand Chameleon Ultra card cloning and are using it solely on cards and systems you are authorized to test or manage. Review the helper script first, use a trusted official chameleon_cli_main binary, expect a Windows first-run pip install of pywinpty, and avoid batch command files or attack/key-recovery workflows unless you have explicit permission and know the device/card-state risks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

file=sys.stderr)
        try:
            subprocess.run([sys.executable, "-m", "venv", venv_dir], check=True)
            subprocess.run([venv_python, "-m", "pip", "install", "-q", "--upgrade", "pip"],
                           check=True)
            subprocess.run([venv_python, "-m", "pip", "install", "-q", "pywinpty"], check=True)
        except subprocess.CalledProcessError as e:

• Confidence: 88% confidence
• Finding: subprocess.run([venv_python, "-m", "pip", "install", "-q", "--upgrade", "pip"], check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.run([sys.executable, "-m", "venv", venv_dir], check=True)
            subprocess.run([venv_python, "-m", "pip", "install", "-q", "--upgrade", "pip"],
                           check=True)
            subprocess.run([venv_python, "-m", "pip", "install", "-q", "pywinpty"], check=True)
        except subprocess.CalledProcessError as e:
            print(f"[!] Failed to install pywinpty: {e}", file=sys.stderr)
            print("    Make sure network access is available, then retry.", file=sys.stderr)

• Confidence: 91% confidence
• Finding: subprocess.run([venv_python, "-m", "pip", "install", "-q", "pywinpty"], check=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to read and write local configuration, invoke shell commands, and potentially install dependencies, yet it does not declare corresponding permissions or boundaries. This creates hidden capability expansion, making it easier for the skill to perform system-affecting actions without clear review or user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The README presents the skill as a convenience layer for legitimate card management, but also explicitly supports automating arbitrary Chameleon CLI commands. In the context of a device capable of card cloning, emulation, and MIFARE attack workflows, exposing unrestricted command automation materially broadens misuse potential and weakens any safety framing.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documented `--file` feature allows batch execution of command files, which enables unattended execution of any supported device commands at scale. Given the skill's stated support for cloning, emulation, and attack-related operations, this increases the risk of abuse, including scripted offensive RFID actions, without meaningful guardrails.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The bootstrap block creates a venv, upgrades pip, installs pywinpty, and then re-executes the script, which materially broadens the skill from local CLI orchestration into package installation and network-enabled code acquisition. In a security-sensitive skill that can already drive RFID attack commands, this hidden expansion of capability increases risk because users may not expect or audit third-party code fetched at runtime.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README openly advertises cloning, emulation, and attack-related card operations but does not provide concrete warnings about risks such as overwriting device/card slots, corrupting dumps, unauthorized duplication, or legal and security consequences. In this skill context, omission of operational and security warnings makes unsafe use more likely, especially for non-expert users.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger scope is extremely broad, effectively covering any Chameleon CLI operation, including sensitive actions such as card attacks, device reconfiguration, and arbitrary command automation. Overly broad routing increases the chance that the skill is invoked for risky operations without contextual safeguards, authorization checks, or narrower intent validation.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly supports MIFARE Classic attacks, key recovery, logging/sniffing workflows, and device setting changes, but it provides no meaningful user-risk warnings, authorization checks, or misuse deterrents. In this hardware/security context, these capabilities can facilitate credential extraction, unauthorized card cloning, and tampering with access-control systems, making the omission materially dangerous.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill persists an executable path to config.json and may create a local virtual environment and install pywinpty over the network, but it does not clearly warn the user about these system changes. This can lead to unexpected persistence, execution of user-supplied binaries, and unanticipated network/package activity, which is especially risky in an agent-driven shell context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.