天津安信华瑞科技有限公司-可燃气体报警器主机-配套技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:44 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its gas-reporting purpose, but its template includes automatic hardcoded OTA updates and overbroad identifier sharing that need review before deployment.

Review before installing or deploying. Disable or replace the default OTA endpoint, require signed update manifests and hash verification before any update or reboot, minimize identifiers sent to update services, and confirm the customer explicitly needs IMEI, ICCID, or IMSI in telemetry.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/template/main.py:325

Finding

Remote OTA Packages Are Installed Without Cryptographic Authenticity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/template/main.py:382

Finding

IMEI, IMSI, and Sensor Telemetry Are Disclosed to a Hardcoded OTA Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: assets/template/modbus.py:102

Finding

Modbus RTU Responses Are Accepted Without CRC and Responder Validation

Content

View full analysis

0x10: # 错误响应（0x83 等异常码） print("[Modbus] 从机返回异常码:", hex(func_code)) return {"ok": False, "data": []} byte_count = int(hex_list[2], 16) if byte_count != reg_count * 2: print("[Modbus] 数据字节数不符，期望", reg_count * 2, "实得", byte_count) return {"ok": False, "data": []} if len(hex_list) < expected_len: print("[Modbus] 报文太短，期望", expected_len, "实得", len(hex_list)) return {"ok": False, "data": []} # 数据区：跳过地址/功能码/字节数，去掉末尾 CRC 两字节 payload = hex_list[3 : 3 + byte_count] return {"ok": True, "data": [b.decode() for b in payload]} except Exception as e: print("[Modbus] 解析失败:", e) return {"ok": False, "data": []} ``` ```python # assets/template/modbus.py:145-159 hex_list = self._recv_hex_list() try: func_code = int(hex_list[1], 16) if func_code != 0x10: # FC=16 正常响应为 0x10 (16) print("[Modbus] 写寄存器异常响应:", hex(func_code)) return {"ok": False, "reg_count": 0} return {"ok": True, "reg_count": int(hex_list[2], 16)} except Exception as e: print("[Modbus] 写寄存器响应解析失败:", e) return {"ok": False, "reg_count": 0} ``` ### Technical Analysis The driver calculates and appends CRC16 values to outbound frames, but it never validates the CRC16 of received frames. The read path also fails to verify that: - The response slave address matches the requested slave. - The function code is exactly the requested read function (`0x03`). - The frame has exactly the expec ...[truncated 2020 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on AX100 gas detector data acquisition over Modbus RTU and HTTP reporting in QuecPython. The actual code chunk does none of that: it is a standalone hardware utility for controlling an LED through a GPIO pin. This is not a supporting implementation detail for the declared behavior as presented, because the code contains only LED control logic and no telemetry, protocol, controller, or networking functionality related to the stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code is a generic Modbus RTU transport/helper module, not a full skill for collecting AX100 gas controller data and uploading it over HTTP. While Modbus RTU communication is consistent with part of the description, the primary declared purpose emphasizes end-to-end data acquisition and HTTP reporting for AX100 devices. Those key behaviors are not present in this chunk. Additionally, the code exposes write-multiple-registers functionality, which goes beyond the declared read-and-report framing. This is therefore a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill content is presented entirely in Chinese and the title/use instructions assume Chinese-language operation, but there is no indication that the user may choose another language. This creates a locale/language policy concern because the skill effectively imposes a specific language without documenting opt-in or a justified regional constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

示例一：换上报地址 + 改频率

text

用户：上报地址改成 https://api.xxx.com/gas/upload，每5分钟上报一次

→ 只修改 config.py：

python

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

示例一：换上报地址 + 改频率

text

用户：上报地址改成 https://api.xxx.com/gas/upload，每5分钟上报一次

→ 只修改 config.py：

python

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

1. 工具：使用 QPYcom（移远官方 PC 工具）连接模组
2. 上传路径：所有 `.py` 文件 → 模组 `/usr/` 目录
3. 自动运行：在 QPYcom「文件」标签页中，将 `main.py` 设为 `auto run`
4. 日志查看：通过 QPYcom 串口终端查看 `print` 输出，定位问题

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s stated purpose is Modbus-to-HTTP gas reporting, but the code also imports and uses OTA update functionality that can download files and trigger an immediate reboot. In an industrial gas-monitoring context, hidden remote update capability materially expands the trust boundary and creates a path for remote code modification or device disruption if the OTA channel or server is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The network setup collects and later uses highly sensitive device and subscriber identifiers including IMEI, IMSI, and ICCID. Transmitting such identifiers without clear minimization or disclosure increases privacy and tracking risk, and if intercepted or mishandled can expose fleet inventory and subscriber metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The OTA path downloads files from a server-controlled list and immediately sets an update flag and reboots, with no operator confirmation, maintenance window, integrity check shown in this file, or safety interlock. In a gas-detection system, an unexpected reboot or malicious update could interrupt monitoring or replace trusted logic at a critical moment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code sends telemetry and the full last reporting payload to a separate OTA endpoint, even though the skill description only mentions reporting to a customer HTTP platform. This creates undisclosed data exfiltration of operational data and device identifiers to an additional service, which is especially sensitive for industrial safety deployments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s human-facing comments, docstrings, and usage descriptions are entirely in Chinese, which imposes a specific language on maintainers or users reading this skill. Under the stated policy, language constraints should either be optional or clearly justified as region-specific; no such opt-in or justification appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This method writes IMEI and IMSI values, which are sensitive device/network identifiers, to the controller via Modbus registers. Although there is a post-action log message, there is no prior user disclosure, confirmation, or warning in this file that sensitive identifiers will be transmitted to external hardware.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide explicitly documents building and transmitting identifiers such as ICCID and full IMEI to a customer HTTP platform, but provides no privacy, minimization, consent, or protection guidance. These identifiers can enable device tracking, inventory correlation, and exposure of telecom subscriber metadata if the platform, transport, or logs are compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This file contains natural-language comments exclusively in Chinese, such as the header and section descriptions, with no indication that the skill is intended only for Chinese-speaking users or maintainers. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file’s human-readable comments, docstrings, and operational messages are written entirely in Chinese, which imposes a specific language on maintainers or operators without any opt-in or alternative. This can violate language/locale policy where tools are expected to offer choice or document locale constraints.

Content

No source excerpt is available for this finding.