T09 · Insecure Skill Coding Practices
Error
- Location
scripts/adb_controller.py:284- Finding
Android-Side Command Injection Through ADB Text Input
- Content
View full analysis
- Remediation
View remediation
Security audit
Scrcpy Claw
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Android-control helper, but it can perform powerful device actions without built-in confirmations and contains a text-input command-injection risk.
Review before installing. Use this only with Android devices you own or have explicit permission to control, preferably test devices. Avoid sensitive apps and passwords until the text-input command-injection issue is fixed, keep Wi-Fi ADB disabled unless needed, and require manual approval before uninstalling apps, clearing app data, sending messages, recording screens, or replaying saved actions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill markets screen analysis, AI automation, and script recording/playback as present even though static analysis indicates those features may be absent. While this is less directly dangerous than hidden extra capability, it still creates a trust and safety problem because users and orchestration systems may rely on inaccurate claims when granting access or choosing the skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill markets screen analysis, AI automation, and script recording/playback as present even though static analysis indicates those features may be absent. While this is less directly dangerous than hidden extra capability, it still creates a trust and safety problem because users and orchestration systems may rely on inaccurate claims when granting access or choosing the skill.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description highlights extensive device-control features but omits warnings about privacy, destructive system actions, clipboard access, screenshots, recording, and app manipulation. In this context, absence of user-facing warnings is dangerous because the skill can affect a real Android device and expose sensitive personal or enterprise data.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
python # 让 AI 自动完成任务 / Let AI complete tasks engine.run_automation("打开微信发送消息给张三") # Open WeChat and send message to Zhang San故障排除 / Troubleshooting
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description promotes device automation, system operations, and script recording/playback without disclosing that these capabilities can modify settings, interact with apps, capture sensitive on-screen data, or replay privileged actions on a connected device. Because this skill is specifically built for Android control via ADB/scrcpy, the lack of safety warnings and consent framing makes accidental or insufficiently informed use materially more dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README promotes comprehensive Android device control, including system operations and AI-assisted automation, but does not clearly warn about privacy, consent, or destructive-impact risks. In a skill explicitly designed for remote control and automation of real devices, omission of safety guidance can enable misuse such as unauthorized access, data exposure, or disruptive device actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples demonstrate opening apps, taking screenshots, and entering text without any nearby warning about sensitive-data exposure, unintended message sending, or the need for user consent. Because this skill is meant for live Android control, copy-pastable examples can normalize potentially invasive or harmful actions and make accidental misuse more likely.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and demonstrates powerful device-control behaviors that inherently imply shell, file, and possibly network access, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because a host agent may invoke the skill without clear least-privilege constraints, enabling broader execution and data access than users would reasonably expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation guidance is broad enough to match many generic Android-related user requests, which increases the chance that this high-privilege device-control skill is invoked in situations where it is unnecessary. Over-broad triggering is dangerous because it expands exposure of shell/device-control functionality and can bypass more specialized, lower-risk alternatives.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The examples normalize recording, saving, and replaying device interactions without warning that these artifacts may contain credentials, messages, or personal data. Demonstrating messaging and persistent action logs without consent language increases the risk of accidental surveillance, leakage, or misuse in downstream implementations.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def _verify_adb(self) -> None: """Verify ADB is available and device is connected.""" try: result = subprocess.run( [self.adb_path, "devices"], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["-s", self.device_id]) cmd.extend(args) result = subprocess.run( cmd, capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
clear_app_data issues
pm cleardirectly and irreversibly wipes an app's local data with no built-in confirmation, warning, or policy check. In an agent skill designed for remote Android control and automation, this is more dangerous because an upstream prompt, script, or mistaken action could silently destroy user data on the device.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The uninstall method removes packages immediately with no explicit user acknowledgment that the action is destructive and may remove app data. Given this skill's context of broad remote device control, lack of confirmation increases the chance of accidental or prompt-induced removal of important apps.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if self.device_id: cmd.extend(["-s", self.device_id]) cmd.extend(args) result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) return result.returncode, result.stdout, result.stderr def dump_ui(self) -> List[UIElement]:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code dumps the device UI hierarchy to /sdcard and then pulls it to a local file, which can copy screen text, labels, content descriptions, and resource identifiers off-device without any explicit disclosure or consent flow. In this skill context, screen analysis is expected, but the off-device persistence of potentially sensitive UI data increases privacy risk if logs, temp files, or host storage are exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The automation loop executes taps, swipes, key presses, and text input directly from generated suggestions without any confirmation, allowlist, or step-level safety gate. In a device-control skill, this can cause unintended sensitive actions such as sending messages, changing settings, approving prompts, or entering secrets, especially if the goal text is ambiguous or influenced by untrusted input.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python SET_CLIPBOARD = 9 SET_DISPLAY_POWER = 10 ROTATE_DEVICE = 11 UHID_CREATE = 12 UHID_INPUT = 13 UHID_DESTROY = 14 OPEN_HARD_KEYBOARD_SETTINGS = 15
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["-s", self.device_id]) cmd.extend(["push", self.scrcpy_server_path, "/data/local/tmp/scrcpy-server.jar"]) result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"Failed to push server: {result.stderr}") return False
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["-s", self.device_id]) cmd.extend(["push", self.scrcpy_server_path, "/data/local/tmp/scrcpy-server.jar"]) result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"Failed to push server: {result.stderr}") return False
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["-s", self.device_id]) cmd.extend(["push", self.scrcpy_server_path, "/data/local/tmp/scrcpy-server.jar"]) result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"Failed to push server: {result.stderr}") return False
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["-s", self.device_id]) cmd.extend(["shell", server_cmd]) self.server_process = subprocess.Popen( cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if self.device_id: cmd.extend(["-s", self.device_id]) cmd.extend(["forward", "--remove", f"tcp:{self.local_port}"]) subprocess.run(cmd, capture_output=True) def _find_available_port(self) -> Optional[int]: """Find an available local port."""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code provides direct remote device-control primitives such as launching apps and issuing system actions without any user-facing disclosure, authorization check, or safety interlock. In the context of an agent skill for Android control, this materially increases the risk of unauthorized app launches, navigation, settings changes, or interaction with sensitive apps under agent control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill exposes clipboard modification and optional paste directly onto a connected Android device without any built-in confirmation, warning, or policy gating. In an agent setting, this can silently overwrite clipboard contents, inject commands, messages, or secrets into focused apps, and cause unintended actions or data leakage.
- Content
Static analysis
No suspicious patterns detected.