BYD Remote Control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it can remotely control a real vehicle and lacks enough safeguards around credentials, target selection, and failed command-access checks.

Install only if you are comfortable giving the skill scripts access to your BYD account credentials, control PIN, VIN, telemetry, and remote vehicle controls. Before using state-changing commands, set BYD_VIN or BYD_VEHICLE_ALIAS explicitly, protect the .env file, avoid committing it, and review or patch the climate scripts so failed command-access verification stops execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/start_ac.py:29

Finding

Climate Start Proceeds After Command-Access Verification Failure

Content

View full analysis

time_span 3. hvac_params = ClimateStartParams( temperature=21.0, time_span=minutes_to_time_span(20), ) print("🌬️ Starting A/C...") result = await client.start_climate(vin=vin, params=hvac_params) ``` ### Technical Analysis The script treats `verify_command_access()` as a non-blocking advisory check. It catches every exception through `except Exception`, prints a warning, and continues to call `start_climate()`. Consequently, failures caused by an invalid control PIN, denied command access, authentication problems, API errors, network failures, or unexpected library behavior do not stop the physical vehicle-control operation. This is a fail-open authorization pattern. The remote BYD service or `pybyd` library may independently reject an unauthorized climate request, but that downstream behavior is external to this project and does not correct the insecure control flow in the script. The local code should require a successful verification result before attempting the command. ### Attack Path 1. An operator or automation invokes `scripts/start_ac.py` with access to the configured BYD account. 2. `verify_command_access(vin)` raises an exception because verification is denied, invalid, unavailable, or otherwise unsuccessful. 3. The broad exception handler suppresses the failure and only prints a warning. 4. The script constructs the climate-control parameters. 5. The script submits `start_climate()` for the selected vehicle despite the i ...[truncated 889 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/stop_ac.py:27

Finding

Climate Stop Proceeds After Command-Access Verification Failure

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:15

Finding

Security-Sensitive Third-Party Dependency Is Unpinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/byd_common.py (reported line 12)May include surrounding context.

python

SCRIPT_DIR = Path(__file__).resolve().parent
ENV_PATH = SCRIPT_DIR / ".env"
VEHICLE_VIN_ENV = "BYD_VIN"
VEHICLE_ALIAS_ENV = "BYD_VEHICLE_ALIAS"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/byd_common.py (reported line 18)May include surrounding context.

python

def load_env_file(path: Path = ENV_PATH) -> None:
    """Load KEY=VALUE pairs from a .env file into os.environ (no overwrite)."""
    if not path.is_file():
        return
    for raw in path.read_text().splitlines():

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes capabilities that rely on environment variables and local file access but does not declare an explicit tool/permission scope. That weakens reviewability and containment, making it easier for an agent or operator to invoke code paths with access to secrets or local files without clear upfront authorization boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill performs real remote vehicle actions such as locking, flashing lights, and starting climate control, but the description does not warn that these operations change physical vehicle state. Missing warnings increase the chance of unintended or unsafe activation, especially in automated or loosely supervised agent workflows where commands may be executed without the user appreciating their real-world effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup instructions direct users to store highly sensitive BYD account credentials and a control PIN in a local .env file without any warning about secure storage, file permissions, exclusion from version control, or credential rotation. This increases the risk of credential leakage through accidental commits, local compromise, backups, or shared workspaces, which could enable unauthorized access to vehicle data and remote-control functions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example usage lists scripts that can remotely lock the car, flash lights, and start or stop A/C, but gives no warning that these commands actively change vehicle state. In a remote-control vehicle skill, omission of operational safety warnings can cause unintended activation, misuse on the wrong vehicle, or execution without understanding the real-world effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script prints the full VIN together with battery state and timestamped telemetry to stdout as JSON, which can expose sensitive vehicle identifiers and location/usage-adjacent data to logs, shell history, calling processes, or monitoring systems. In the context of a remote-control vehicle skill, this increases privacy and targeting risk because VINs and live status data can be used to identify a specific vehicle and support further unauthorized tracking or social-engineering attacks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends a real-world control command to a vehicle by invoking flash_lights, which may trigger lights and horn, but there is no visible confirmation prompt, warning message, or explanatory comment for the user before execution. Because this is a safety-relevant physical action affecting an external device, the absence of any user disclosure makes unintended activation harder to detect or prevent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code accesses and propagates credential-like values from the environment, specifically bridging BYD_PIN into BYD_CONTROL_PIN, which is a safety-relevant handling of sensitive configuration. Although there are internal docstrings, there is no user-facing warning, confirmation, or visible logging that credential material is being consumed and reused at runtime.

Content

No source excerpt is available for this finding.