Security audit

Droidrun Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not deceptive, but it gives an AI broad Android device control, including screenshots and APK installation, without documented guardrails.

Install only for authorized devices you are comfortable letting an AI control. Prefer a test device, restrict the Portal token and network reachability, disable or block APK installation unless explicitly needed, require human confirmation for screenshots and state-changing actions, and pin or verify the droidrun-agent package before using the uvx MCP configuration.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:212
Finding: Unpinned Third-Party Package Retrieval and Immediate Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:202
Finding: AI-Accessible Remote APK Installation Without Documented Safety Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly advertises screenshot capture, UI state retrieval, and phone state access, which can expose sensitive on-device data such as messages, credentials visible on screen, app context, and other personal information. In an agent-integrated setting, presenting these capabilities without an explicit warning or consent boundary increases the risk that an agent or user invokes privacy-invasive actions without understanding their sensitivity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented actions include app launching/stopping, key presses, global actions, text input, port changes, and APK installation, all of which can alter device state or install software. Without any warning about destructive or system-affecting behavior, an agent may treat these as routine operations and perform unsafe actions on a real device, potentially disrupting the user, changing settings, or installing untrusted software.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.