PAO System

• Outcome: Review
• Latest audit: May 28, 2026 · 1:05 PM UTC
• Version: 1.1.2

Overview

This skill is a cross-device AI coordination system, but it exposes network task and discovery features with weak scoping and more local device data sharing than users may expect.

Install only if you intend to run a networked, cross-device PAO system. Before use, bind listeners to localhost or a trusted interface, add authentication, disable discovery/sync/memory sharing unless needed, avoid running on untrusted LANs, and review what data is stored under ~/.pao and exposed through device discovery.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (46)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"[INFO] 开始安装缺失依赖: {missing}")
    try:
        subprocess.run(
            [sys.executable, "-m", "pip", "install"] + missing,
            check=True,
        )

• Confidence: 87% confidence
• Finding: The script executes pip as a subprocess to install packages at runtime. While the package list is hardcoded and not directly user-controlled, this still performs network-retrieved code installation and execution on the host, which is a meaningful supply-chain and environment-modification risk for an initialization script.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill metadata declares no permissions even though the referenced functionality implies access to environment variables, files, network communication, and shell/subprocess execution. This is dangerous because users and hosting platforms cannot accurately assess or constrain the skill's capabilities, increasing the risk of overprivileged execution and unexpected sensitive operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a relatively bounded assistant for skill and protocol management, but the analyzed behavior indicates substantially broader capabilities such as device discovery, persistent memory sync, remote task execution, dependency installation, and audit/logging subsystems. This mismatch is dangerous because it conceals the true operational scope of the skill, undermining informed consent and making high-risk behaviors more likely to be deployed without proper review or restrictions.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The configuration declares PrivacyLevel.MAXIMUM as 'no network', but the default config still leaves network-capable features enabled, including discovery, sync, memory sharing, UPnP, and IPv6. This mismatch can cause users or higher-level code to assume the strongest privacy posture is enforced when network behavior may still remain active, leading to unintended exposure of metadata or data.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code gathers detailed host fingerprinting data including OS version, CPU core count, memory size, storage size, and MAC address, then stores it in the device object used for discovery. In a Zeroconf-based LAN discovery context, this creates unnecessary device profiling data that can help attackers identify high-value targets, track devices, or tailor follow-on attacks.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The service publishes self.local_device.to_dict() as Zeroconf TXT properties, which appears to advertise all collected device metadata to any host on the local network. This broad exposure leaks internal system details without authentication and makes passive reconnaissance trivial for anyone on the same network segment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The logger accepts an arbitrary file path and writes attacker-influenced event content to it without path validation or confinement. In a larger system where untrusted configuration or plugin input can control `log_file`, this can enable unauthorized file creation/appending, overwrite-adjacent abuse, or tampering with application data and logs.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill description frames this as a personal AI/operator assistant, but the integrator initializes device discovery, peer communication, heartbeat tracking, and synchronization across other devices. That materially expands the trust boundary and can expose local state, memory, and operational metadata to peer systems without the manifest clearly disclosing those capabilities, increasing the risk of unintended lateral communication and data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The code loads a memory subsystem on startup and exposes APIs to store and retrieve memories, which implies persistent handling of potentially sensitive user data beyond a narrow assistant/management role. When combined with the system's sync and peer features, this creates meaningful risk of retaining or propagating sensitive information without clear disclosure or minimization controls.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code gathers unusually detailed host fingerprinting data for LAN discovery, including OS version, CPU/memory/storage characteristics, and the MAC address. Even on a local network, this creates unnecessary device profiling data that can aid reconnaissance, device tracking, and targeting if any untrusted party can observe Zeroconf advertisements.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The service serializes the full local device profile and publishes it in Zeroconf properties, broadcasting sensitive host metadata to anyone on the LAN able to browse mDNS. This increases exposure beyond basic service discovery and turns discovery traffic into a reconnaissance channel.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The initialization routine goes beyond passive setup checks and installs software onto the local system. In a skill context, undisclosed package installation expands trust boundaries and can expose users to supply-chain compromise, environment drift, or unexpected privilege-sensitive changes.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module collects detailed host characteristics and runtime telemetry including platform version, machine type, processor, CPU, memory, disk, and battery data despite the stated skill purpose being a PAO assistant / skill-management system. This creates unnecessary device profiling and expands privacy risk because the data can be used for fingerprinting, tracking, or environment targeting without any visible minimization, consent, or purpose limitation in the code.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The get_device_id method constructs a stable identifier from host-specific attributes (platform.node and platform.machine), which is a classic fingerprinting primitive. In the context of an assistant skill, this enables persistent tracking across sessions and can facilitate correlation of user activity or targeting of a specific device.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The code derives a persistent device identifier from the local username and machine environment, which can create a stable fingerprint across sessions and deployments. In an assistant platform with discovery, sync, and memory-sharing features enabled by default, this increases privacy risk and can aid tracking or correlation of a user's identity.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code gathers a broad host fingerprint including OS/version, CPU core count, RAM, disk size, MAC address, device type, and capabilities, which goes beyond what is needed for basic LAN service discovery. Exposing this metadata to nearby network peers increases device fingerprinting, tracking, and targeting risk, especially because MAC address and hardware characteristics can uniquely identify a host.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The service registration publishes the full device metadata dictionary over Zeroconf properties to all listeners on the local network. This makes sensitive host-identifying information trivially discoverable by any local attacker or untrusted device on the same LAN, enabling reconnaissance and more precise exploitation planning.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The demo server listens on 0.0.0.0 and the shown flow includes no authentication, authorization, or origin/access restrictions before accepting and processing messages. In a personal AI operator context, exposing a control or messaging interface to the entire network materially increases the attack surface and could allow unauthorized remote interaction if the demo code is reused in production or run on an untrusted network.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The component is presented as a workspace task listener, but it accepts attacker-controlled task parameters that can trigger outbound HTTP requests and callback POSTs to arbitrary URLs. In a network-exposed service, this creates SSRF and unintended data exfiltration paths that are more dangerous than the documentation suggests.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file_search and code_analysis handlers allow a remote task sender to enumerate filesystem paths and read arbitrary files by providing user-controlled path values. If the listener is reachable by untrusted clients, this can expose sensitive source code, secrets, configuration files, or host metadata.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The web_fetch handler performs server-side requests to any attacker-supplied URL with no validation or destination controls. This enables SSRF against internal services, cloud metadata endpoints, and other network resources reachable from the host running the listener.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Overly broad or everyday trigger phrases increase the chance that the skill is invoked unintentionally during normal conversation. In a skill with network, file, and automation-related capabilities, accidental activation can cause unintended actions, data access, or workflow execution without the user's clear intent.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The DeviceInfo dataclass automatically captures the local hostname and resolves an IP address at object creation, which collects potentially sensitive host metadata without any explicit opt-in, disclosure, or minimization. In a multi-device orchestration assistant, this increases privacy and fingerprinting risk because these identifiers may later be serialized, transmitted, or logged by default.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code transmits device characteristics over the network as part of discovery, but there is no evidence of user notice, consent, or configuration to disable or limit that behavior. For a personal AI operator skill, silent broadcasting of local host details increases privacy risk and may surprise users who would not expect hardware and identifier data to be shared on the LAN.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The uninstall routine recursively deletes directories under the user's home and config paths without any confirmation, dry-run, or display of exactly what will be removed. In an agent/skill context, this is dangerous because uninstall actions may be triggered with limited user awareness, leading to irreversible data loss or removal of user-modified configuration.

Static analysis

No suspicious patterns detected.