Control your vehicle from AI agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:08 AM UTC
• Version: 1.1.2

Overview

This vehicle-query skill is purpose-aligned, but it handles live vehicle/location data and local credentials with weak disclosure and insecure local file handling.

Install only if you are comfortable giving the skill access to vehicle tokens and live vehicle location/status data. Use it on a single-user trusted machine, avoid running it with sudo, protect or delete ~/.carkey_cache.json and ~/.carkey_history.json, and be aware that query history may include physical locations and vehicle identifiers.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vehicle-query.sh:182

Finding

Sensitive vehicle data is stored without restrictive file permissions

Content

View full analysis

"$CACHE_FILE" << EOF { "accessToken": "$accessToken", "vehicleToken": "$vehicleToken", "last_updated": "$(date -Iseconds 2>/dev/null || date '+%Y-%m-%dT%H:%M:%S')" } EOF log_success "认证信息已保存" } ``` The history-writing function contains: ```bash save_history() { local response="$1" local query_type="$2" local timestamp=$(date +%s) local address=$(echo "$response" | jq -r '.data.vehiclePosition.address // "未知"') local history="[]" if [ -f "$HISTORY_FILE" ]; then history=$(jq '.queries // []' "$HISTORY_FILE" 2>/dev/null || echo "[]") fi local new_record=$(cat << EOF { "timestamp": $timestamp, "type": "$query_type", "address": "$address", "sn": "$(echo "$response" | jq -r '.data.sn // "未知"')" } EOF ) echo "$history" | jq --argjson new "$new_record" '. + [$new] | .[-10:]' > "${TMP_DIR}/history_tmp.json" jq -n --slurpfile queries "${TMP_DIR}/history_tmp.json" '{queries: $queries[0]}' > "$HISTORY_FILE" rm -f "${TMP_DIR}/history_tmp.json" } ``` File creation permissions are inherited from the process umask. Under a common umask of `022`, newly created regular files may have mode `0644`, allowing other local users to read them. The cache is designed to contain bearer and vehicle tokens. The history contains a vehicle address, serial number, query type, and timestamp. These values are security- and privacy-sensitive. The current `main` function does not call `save_tokens`, s ...[truncated 1544 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vehicle-query.sh:384

Finding

Predictable shared temporary file enables symlink and race attacks

Content

View full analysis

/dev/null || echo "[]") fi local new_record=$(cat << EOF { "timestamp": $timestamp, "type": "$query_type", "address": "$address", "sn": "$(echo "$response" | jq -r '.data.sn // "未知"')" } EOF ) echo "$history" | jq --argjson new "$new_record" '. + [$new] | .[-10:]' > "${TMP_DIR}/history_tmp.json" jq -n --slurpfile queries "${TMP_DIR}/history_tmp.json" '{queries: $queries[0]}' > "$HISTORY_FILE" rm -f "${TMP_DIR}/history_tmp.json" } ``` On Linux and macOS, `TMP_DIR` is configured as the shared `/tmp` directory. The shell redirection operator follows symbolic links and does not perform exclusive file creation. Consequently, another local user can create `/tmp/history_tmp.json` before the victim runs the script. If the path is a symbolic link, the initial redirection truncates and writes to the linked target with the victim's privileges. If it is a pre-created attacker-controlled regular file, the script writes vehicle history into that file while preserving its existing ownership and permissions, allowing the attacker to read the data before or after the attempted cleanup. Concurrent script executions also use the same temporary path, so one invocation can overwrite another invocation's intermediate data and cause corrupted or mismatched history. ### Attack Path A symlink-based attack can proceed as follows: 1. A local attacker predicts th ...[truncated 1634 chars]

Remediation

View remediation

"$history_tmp" jq -n --slurpfile queries "$history_tmp" \ '{queries: $queries[0]}' > "$HISTORY_FILE" ``` 4. Prefer creating temporary files inside a private directory owned by the current user rather than directly under `/tmp`: ```bash private_tmp="${XDG_RUNTIME_DIR:-$HOME/.cache/carkey}" mkdir -p -- "$private_tmp" chmod 700 "$private_tmp" ``` 5. Use a separate temporary file for the destination history and atomically rename it after successful validation. This prevents partially written history files. 6. Add locking, such as `flock` where available, or another cross-platform locking mechanism to prevent concurrent invocations from overwriting each other's intermediate state. 7. Validate that cache, history, and temporary paths are regular files owned by the current user and reject symbolic links. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/vehicle-query.sh (reported line 406)May include surrounding context.

sh

echo "$history" | jq --argjson new "$new_record" '. + [$new] | .[-10:]' > "${TMP_DIR}/history_tmp.json"
  jq -n --slurpfile queries "${TMP_DIR}/history_tmp.json" '{queries: $queries[0]}' > "$HISTORY_FILE"
  rm -f "${TMP_DIR}/history_tmp.json"
}

# ==================== 主函数 ====================

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly states that authentication information is automatically cached for later reuse, but it does not warn users that sensitive tokens will persist on disk or describe how they are protected. In the context of a vehicle-status/location skill, cached tokens may allow unauthorized access to live vehicle telemetry and location data if the local account or filesystem is compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt-get install curl jq

Linux (CentOS/RHEL)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt-get install curl jq

Linux (CentOS/RHEL)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt-get install curl jq

Linux (CentOS/RHEL)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill clearly instructs the agent or user to execute a shell script, but the manifest/documentation does not declare any tool scope or allowed-tools boundary. That increases the chance an agent will invoke shell execution without explicit permission controls or user awareness, which is a real security weakness for a skill that handles credentials and makes system calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks for sensitive authentication tokens and says they will be automatically cached locally, but it provides no warning about local credential storage risks, file permissions, shared-user systems, or token lifecycle. Because these tokens appear to grant access to vehicle location and status, disclosure could expose sensitive physical-location and account data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

| 系统 | 依赖安装 |
|------|----------|
| Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` |
| Linux (CentOS/RHEL) | `sudo yum install curl jq` |
| macOS | `brew install curl jq` |
| Windows (Git Bash) | 已包含 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

| 系统 | 依赖安装 |
|------|----------|
| Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` |
| Linux (CentOS/RHEL) | `sudo yum install curl jq` |
| macOS | `brew install curl jq` |
| Windows (Git Bash) | 已包含 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

| 系统 | 依赖安装 |
|------|----------|
| Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` |
| Linux (CentOS/RHEL) | `sudo yum install curl jq` |
| macOS | `brew install curl jq` |
| Windows (Git Bash) | 已包含 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/vehicle-query.sh (reported line 154)May include surrounding context.

sh

| 系统 | 依赖安装 |
|------|----------|
| Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` |
| Linux (CentOS/RHEL) | `sudo yum install curl jq` |
| macOS | `brew install curl jq` |
| Windows (Git Bash) | 已包含 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/vehicle-query.sh (reported line 155)May include surrounding context.

sh

| 系统 | 依赖安装 |
|------|----------|
| Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` |
| Linux (CentOS/RHEL) | `sudo yum install curl jq` |
| macOS | `brew install curl jq` |
| Windows (Git Bash) | 已包含 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/vehicle-query.sh (reported line 159)May include surrounding context.

sh

| 系统 | 依赖安装 |
|------|----------|
| Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` |
| Linux (CentOS/RHEL) | `sudo yum install curl jq` |
| macOS | `brew install curl jq` |
| Windows (Git Bash) | 已包含 |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

All user-facing messages, prompts, and labels in the script are written in Chinese, with no indication that language can be configured or that the tool is intentionally limited to a Chinese-speaking context. This can violate a language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script persists highly sensitive authentication material (accessToken and vehicleToken) in a predictable file under the user's home directory without any file-permission hardening, encryption, or user warning. Those tokens can be reused to query vehicle location and status, so local compromise, backup leakage, or multi-user access could expose ongoing access to private vehicle telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script silently writes authentication tokens to a local cache file, but gives users no notice that credentials will persist after execution. Lack of transparency around secret persistence increases the chance of accidental credential exposure, especially on shared systems, synced home directories, or systems with permissive default file modes.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/vehicle-query.sh (reported line 227)May include surrounding context.

sh

local response
  
  while [ $retry -lt $MAX_RETRIES ]; do
    response=$(curl -s -X POST "${API_BASE_URL}/iot/v1/condition" \
      -H "Authorization: Bearer ${accessToken}" \
      -H "Content-Type: application/json" \
      -d "{\"vehicleToken\": \"${vehicleToken}\"}" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This curl request transmits a bearer access token and vehicle token to an external service to retrieve vehicle status and location data. While the script logs that it is querying vehicle information, it does not clearly disclose that sensitive location and account-linked data are being sent over the network to a third-party endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README presents the skill description and user interaction example entirely in Chinese, including the expected query and authentication instructions. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions, usage guidance, and examples all assume Chinese without indicating an opt-in or documented locale restriction. Under the policy, forcing a specific language without user choice can be a language/locale policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script stores query history including timestamps, addresses, and device identifiers locally even though this is not required for a simple vehicle-status query function. This creates an unnecessary privacy footprint: anyone with access to the host or its backups may learn where the vehicle was queried from and when.

Content

No source excerpt is available for this finding.