Control your vehicle from AI agent

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.1.2

Overview

This vehicle lookup skill does what it claims, but it stores sensitive vehicle tokens and recent location query history on disk with limited protection and control.

Install only if you are comfortable with this skill storing vehicle API tokens and recent location query history locally. Avoid using it on shared or unmanaged machines, restrict or delete ~/.carkey_cache.json and ~/.carkey_history.json when finished, and rotate/revoke the vehicle tokens if those files may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documentation instructs the agent or user to run shell scripts, but the skill metadata shown here does not declare corresponding permissions. Undeclared shell capability reduces transparency and can bypass a permission-gating model, making it harder for users and the platform to understand that local command execution is involved.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated purpose is vehicle lookup, but the behavior includes persistent storage of authentication tokens and query history containing time, query type, address, and vehicle identifiers. This mismatch is dangerous because users may provide highly sensitive credentials and location data without being clearly informed that they will be retained on disk.

Description-Behavior Mismatch

Low

• Confidence: 95% confidence
• Finding: The script persists accessToken and vehicleToken in a plaintext cache file under the user's home directory. These credentials are sufficient to query sensitive vehicle telemetry, so local compromise, shared accounts, backups, or accidental disclosure can expose vehicle data beyond the immediate session.

Description-Behavior Mismatch

Low

• Confidence: 96% confidence
• Finding: The script records query history including vehicle address and device identifier data to a local file without this behavior being part of the advertised read-only lookup function. Persisting location history creates a privacy and stalking risk if the host is accessed by another user or malware.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to paste authentication tokens directly into the skill and states that they are cached automatically, but it does not disclose storage protections, file permissions, retention, or the security/privacy risks of persisting credentials. In a vehicle-information skill, stolen tokens could allow unauthorized access to location and status data, making the omission materially sensitive rather than a purely usability issue.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README documents local persistence of a token cache and query history but does not warn that these files may contain sensitive credentials, vehicle location/status data, and usage history. Because this skill handles vehicle telemetry, local disclosure through shared accounts, backups, malware, or weak file permissions could expose highly sensitive personal information.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The authentication section says tokens are cached automatically, but it does not prominently warn users that long-lived vehicle and access tokens will be written to a local file. For a vehicle-location skill, those tokens can expose sensitive account access and live vehicle data if the host is shared or compromised.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Authentication tokens are written to persistent local storage without any user-facing disclosure or consent. Because these secrets authorize vehicle information access, silent persistence increases the chance of credential leakage through local inspection, backups, or multi-user systems.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Vehicle location and query metadata are silently written to a history file, which users would not reasonably expect from a simple status query skill. This creates undisclosed retention of sensitive movement data that can be exploited by anyone with access to the local account or filesystem.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.