AgentKVM

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:12 AM UTC
• Version: 0.2.1

Overview

This skill is for real device control, but its documentation exposes powerful screenshot and input-control features with weak network and credential-safety guardrails.

Install only if you intentionally want an agent to see and control connected physical devices. Avoid using it for passwords or sensitive sessions, pin and verify the AgentKVM package before installing, and do not expose the HTTP server beyond localhost unless it is protected by strong authentication, TLS or a trusted tunnel, and network firewalling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Globally Installed AgentKVM Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 11 **Vulnerability Type**: Unpinned third-party package installed globally **Risk Level**: Medium ### Vulnerable Code ```yaml compatibility: Requires agentkvm CLI (npm install -g agentkvm), Node.js >= 18, ffmpeg, and NanoKVM-USB hardware connected via USB. ``` ```markdown - **AgentKVM CLI** — `npm install -g agentkvm` ``` ### Technical Analysis The Skill directs users or agents to install the latest available `agentkvm` npm package globally without specifying a reviewed version, lockfile, package integrity hash, or provenance-verification procedure. Consequently, the installed implementation can change after this Skill has been reviewed. Npm installation can also execute package lifecycle scripts with the privileges of the account performing the installation. Global installation increases the package's availability and potential effect across projects. This is a supply-chain weakness rather than evidence that the current `agentkvm` package is malicious. ### Attack Path 1. An attacker compromises the package publisher account, package distribution channel, or a future package release. 2. The attacker publishes a modified `agentkvm` version containing malicious installation or runtime behavior. 3. A user follows the documented `npm install -g agentkvm` instruction. 4. Npm retrieves the current compromised version and may execute its lifecycle scripts. 5. The malicious package runs with the installing user's privileges and can abuse the device-control workflow when subsequently invoked. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions, the package could access local files, environment variables, configuration data, attached hardware, screenshots, and keyboard or mouse control capabilities. Global installation may expose the compromise ...[truncated 47 chars]
• Remediation: ## Remediation Suggestions - Pin `agentkvm` to an explicitly reviewed version instead of installing the latest release. - Record and verify package provenance and integrity before installation. - Prefer a project-local dependency governed by a committed lockfile over a global installation. - Use npm's lockfile integrity data and a trusted internal registry or allowlist where appropriate. - Disable lifecycle scripts during installation when operationally feasible, then explicitly run only reviewed setup steps. - Document the expected package publisher, registry, version, and verification procedure. - Run the CLI using a dedicated, least-privileged account with access restricted to required devices and files.

T09 · Insecure Skill Coding Practices

Error

• Location: references/api.md:129
• Finding: Remote Device-Control Service Can Be Exposed Without Mandatory Authentication or TLS## Vulnerability Details **File Location**: `references/api.md`, lines 129–132 and 190–193; related plaintext remote examples in `SKILL.md`, lines 82–83 **Vulnerability Type**: Unsafe network exposure, optional authentication, and plaintext transport **Risk Level**: High ### Vulnerable Code ```bash agentkvm serve [--host <addr>] [--server-port <n>] [--token <secret>] ``` ```text Starts persistent HTTP server. Default: `0.0.0.0:7070`. ``` ```markdown Base URL: `http://<host>:<port>` (default port 7070) Authentication: `Authorization: Bearer <token>` header (if token configured) ``` Related usage examples: ```bash agentkvm --remote http://192.168.1.100:7070 --token my-secret screenshot --json agentkvm --remote http://192.168.1.100:7070 --token my-secret mouse click 223 485 ``` ### Technical Analysis The documented server binds to `0.0.0.0` by default, making it listen on every available network interface. At the same time, the authentication token is optional, as indicated by both the optional `--token` argument and the phrase “if token configured.” The exposed API is security-sensitive: it supports screenshots, arbitrary text entry, keyboard combinations, mouse movement, clicking, scrolling, and dragging. An unauthenticated network client could therefore observe and operate the connected physical device if port 7070 is reachable. The documentation also uses plaintext HTTP. A bearer token transmitted over HTTP is not protected from a network-positioned attacker. Screenshots, typed content, API requests, and bearer credentials may be intercepted or modified in transit. ### Attack Path **Unauthenticated exposure path:** 1. A user starts `agentkvm serve` without supplying `--token`. 2. The service binds to `0.0.0.0:7070`. 3. A local-network or otherwise network-reachable attacker discovers the open port. 4. The attacker requests `/api/screenshot` to observe the ...[truncated 1409 chars]
• Remediation: ## Remediation Suggestions - Change the default bind address from `0.0.0.0` to `127.0.0.1`. - Require explicit configuration before binding to any non-loopback interface. - Make authentication mandatory and reject non-loopback startup when no token is configured. - Require long, cryptographically random tokens and support secure rotation and revocation. - Protect transport with TLS; alternatively, require a mutually authenticated VPN, SSH tunnel, or equivalent secured channel. - Do not place bearer tokens directly in shell command arguments because they may appear in process listings or shell history; support protected environment variables or permission-restricted token files. - Add rate limiting, failed-authentication throttling, request logging, and endpoint-level authorization. - Restrict access with host firewalls and network allowlists. - Display a prominent warning whenever the server is exposed beyond loopback. - Document that screenshots and input endpoints provide effective control of the attached graphical session and should only be exposed on trusted networks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill metadata explicitly includes prompts like 'type my password on the PC' as activation examples, normalizing credential entry through an automated hardware-control channel without any safety caveat. This is dangerous because it can lead to interception, unintended logging, misuse on the wrong device, or social-engineering-driven credential entry on an attacker-controlled or unverified target.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation criteria are very broad and include ordinary requests like interacting with a phone screen, taking screenshots, clicking buttons, or typing on a PC. In a powerful hardware-control skill, overbroad triggering can cause the agent to invoke real device-control capabilities in situations where the user may only want advice, increasing the chance of unintended screenshots, input injection, or physical device manipulation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The remote operation section enables sending screenshots and control commands to a remote host over HTTP with a bearer-like token, but the skill description does not foreground the privacy and security implications. Screenshots may contain sensitive data and remote input can control real devices; without prominent warnings about trusted endpoints, transport security, token handling, and consent, users may expose device contents or allow unauthorized control.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation exposes capabilities to capture screenshots and inject keyboard/mouse input into physical devices, which can affect user data and system state, but it does not warn operators about the risk of unintended clicks, destructive actions, credential entry, or privacy exposure. In a skill specifically designed for remote GUI control of real hardware, omission of safety guidance increases the chance of misuse or accidental harm even if the feature is intended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that the persistent HTTP server binds by default to 0.0.0.0:7070, which exposes remote screenshot and input-control functionality over the network, yet it does not prominently warn that this may make full device control reachable from other hosts. Because the API can drive real hardware and capture screens, insecure deployment could enable unauthorized observation and manipulation of connected systems.

Static analysis

No suspicious patterns detected.