Security audit

android-auto-controller

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for Android automation, but it needs Review because it can control a real phone and send full screen images plus task goals to a configurable VLM service without strong safeguards.

Install only if you intentionally want an agent to control a real Android phone. Use a trusted local or HTTPS VLM endpoint, avoid showing sensitive notifications or apps during automation, require your own confirmation before messages, purchases, or account changes, and clean up retained screenshot files. Prefer pinned dependencies and an isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/android_agent.py:88
Finding: Potentially Sensitive Android Screenshots Can Be Sent over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/android_agent.py:88
Finding: Sensitive Screenshots Persist in Predictable Working-Directory Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:18
Finding: Third-Party Python Dependencies Are Installed without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The manifest and description materially understate or misrepresent behavior: the skill can perform real actions on a physical phone, access device/app state, and send screenshots to an external VLM endpoint, while claiming stricter guarantees than are actually enforceable. This is dangerous because users and upstream agents may trust false safety claims and authorize actions or data exposure they would not otherwise permit.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: android-auto-controller description: "控制 Android 手机的终极工具。具备视觉状态感知、自动关闭干扰弹窗、模拟人手操作的能力。内置严格的反幻觉校验机制和防绕过限制，以真实的屏幕视觉反馈为唯一判断标准。" metadata: {"openclaw":{"emoji":"📱","requires":{"bins":["python3"],"env":["VLM_API_KEY","VLM_BASE_URL","VLM_MODEL_NAME","VLM_COORD_SCALE"]},"primaryEnv":"VLM_API_KEY"}} --- # 📱 Android Auto Controller (安卓视觉自动化控制) > **🧑‍💻 以下内容为人类用户阅读的安装与配置指南** 这是一个为 OpenClaw �

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares environment requirements and enables code-driven device control, but does not define explicit tool scope such as allowed tools or permissions. In an agent setting, missing scope boundaries can let the model invoke this high-impact skill more freely than intended, especially since it can control a real connected phone and interact with external services via environment-provided VLM credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The user-facing description does not clearly warn that the skill can execute irreversible actions on a real physical phone, including opening apps, entering text, and sending messages. In this context, inadequate disclosure is dangerous because users may invoke the skill without understanding that it can affect live accounts, contacts, and private data on a connected device.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation condition is overly broad ('when the user asks to operate the phone'), making accidental or unnecessary invocation likely for general phone-related requests. Because this skill performs real-world actions on a connected device, broad triggering increases the risk of unintended app launches, taps, text entry, or message sending.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function captures a live device screenshot, encodes it, and sends it to a configurable remote VLM endpoint for UI interpretation. Because phone screens commonly contain messages, contacts, tokens, notifications, and other sensitive data, this creates a real confidentiality risk, especially since the default is an HTTP localhost endpoint and the base URL can be redirected elsewhere without any user-facing consent or trust validation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code transmits screenshot data to a remote model call without any explicit warning or consent flow at the point of collection. Even if remote analysis is intended, the absence of transparent disclosure materially increases privacy risk because users may reasonably assume the automation is analyzing the screen locally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The planning routine sends both a screenshot and the user's high-level goal to an external VLM service, exposing not just visual screen contents but also user intent. In the context of an Android controller, this can reveal private app usage, personal workflows, contacts, financial activity, or other sensitive behavioral data to a third party beyond the stated local phone-control function.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This planning call uploads both screen contents and the user's goal text without clear disclosure, combining two sensitive data sources into a single remote request. In an automation tool with broad device control, that combination can expose especially revealing personal or operational context, making the privacy impact stronger than a screenshot-only upload.
Content: No source excerpt is available for this finding.