Off-grid radio for sovereign AI. LoRa mesh comms via Meshtastic — no internet required.

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:09 AM UTC
• Version: 0.1.0

Overview

This Meshtastic skill is mostly legitimate, but it needs Review because it can publish location/device data externally by default and exposes high-impact radio/device controls without strong safeguards.

Install only if you intend to run an always-on Meshtastic bridge. Before use, set map publishing off in the actual bridge code/config, avoid chmod 666 by using a restricted device group or udev rule, protect or relocate /tmp logs, and require explicit approval before broadcasting position, forwarding digests externally, or rebooting the device.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documentation describes capabilities that include reading and writing files, invoking shell commands, and potentially using environment/configuration data, but it does not declare corresponding permissions. This creates a transparency and consent problem: users may enable a messaging skill without realizing it can access local logs, manipulate services, and interact with the host shell.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The stated purpose suggests simple Meshtastic messaging, but the documented behavior expands into location publishing, MQTT ingestion of global traffic, monitoring/alerting, and broader device-management actions. This mismatch is dangerous because users may authorize or trust the skill under a narrower mental model than its actual surveillance, networking, and control capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The guide instructs users to run a persistent local socket server that accepts JSON commands and can send arbitrary Meshtastic messages, but it shows no authentication, authorization, or peer validation. Even though it binds to 127.0.0.1, any local process, compromised user session, container escape, or forwarded port could abuse it to transmit messages or query node state, expanding the attack surface beyond the skill's stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill exposes direct device-control and active network operations such as sending position, requesting telemetry, traceroute, node inspection, channel enumeration, and reboot, which materially exceed the stated messaging/status purpose. In an MCP context, these extra capabilities increase the blast radius of prompt injection or accidental tool use by allowing surveillance, configuration discovery, and operational interference with a radio device and mesh network.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The reboot tool allows an MCP client to power-cycle the connected Meshtastic device without any strong justification in a messaging skill. This can interrupt emergency or off-grid communications, create denial of service, and be triggered by an untrusted agent workflow or prompt injection chain at exactly the wrong time.

Description-Behavior Mismatch

Medium

• Confidence: 76% confidence
• Finding: The skill exposes map publishing control even though the manifest describes messaging, status, node listing, and message reading. Changing map visibility can affect location/privacy exposure for mesh data and expands the skill's authority beyond what a user may reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The setup wizard performs host inspection and operational guidance outside the declared scope of sending and receiving Meshtastic messages. Undisclosed environment probing reduces transparency and can reveal system details that users did not intend to expose through a messaging skill.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The setup command runs hardware-discovery and system-management checks unrelated to the narrow task of messaging, including USB enumeration and systemd service inspection. In an agent context, this broadens host visibility and operational reach in ways users may not expect from the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script’s documented behavior includes ingesting global MQTT traffic and publishing to a third-party map service, which expands the skill beyond simple local Meshtastic send/receive functionality. That broader data-flow meaningfully changes the trust boundary by introducing external collection and redistribution of network data, creating privacy and unauthorized data-sharing risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code publishes approximate location, node identifier, and device metadata to an external MQTT map service on a recurring basis. Even with fuzzy coordinates, this can expose user presence, movement patterns, and device identity to third parties without strong consent controls, which is especially sensitive for an off-grid messaging tool.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly describes outbound messages being transmitted to the mesh and even 'worldwide' via the MQTT bridge, but it does not place an immediate, prominent warning near that workflow that messages may leave the local device, traverse third-party infrastructure, and be visible beyond intended recipients. In an agent skill context, this increases the chance that a user or autonomous agent sends sensitive content under the mistaken assumption that the system is local or private.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that inbound traffic is logged to /tmp/mesh_messages.txt and later documents the plaintext log format, but it does not clearly warn that received mesh traffic is stored locally in an easily accessible plaintext file. On multi-user systems or systems with weak tmp hygiene, this can expose message contents and metadata to other local processes or users.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README exposes tools for broadcasting GPS position, requesting telemetry, traceroute, and rebooting the connected device, but does not place clear safety warnings adjacent to these capabilities. In an agent-integrated environment, these functions can affect privacy, availability, and operational state if invoked accidentally or by prompt manipulation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill recommends scheduled reading of mesh message logs and forwarding summaries or alerts to external channels such as Telegram without a strong warning that message contents may contain personal, sensitive, or third-party communications. This can lead to unintentional exfiltration of received radio/MQTT content to external services and broadens exposure beyond the local system.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The map publishing and immediate position-report controls can disclose device location to external services, yet the warnings are comparatively understated and placed later under privacy notes. Because the feature is exposed as a simple toggle/command, users may enable it without appreciating that it can publish location or movement data externally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup hard-codes shared MQTT credentials and subscribes to global mesh traffic while also logging received messages to /tmp, but it does not clearly warn users that they may ingest, store, and process third-party communications and metadata. This creates privacy and data-handling risk, and the use of widely known credentials may also normalize insecure deployment practices.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The destructive reboot operation executes immediately and returns success text without any warning, confirmation, cooldown, or safety interlock. In an agent-integrated environment, lack of confirmation makes accidental or adversarial triggering much more likely, turning a sensitive maintenance action into a low-friction denial-of-service primitive.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The messages command reads recent communications from a local log file and prints them without any warning or confirmation. In a shared or agent-driven environment, this can expose sensitive message history to users or workflows that only intended to send messages or check status.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script reads mesh messages from /tmp/mesh_messages.txt and prints the resulting digest, including user-generated message text and sender identifiers, directly to stdout as JSON. In an agent skill context, stdout is commonly captured by orchestration layers, logs, or downstream tools, so this can disclose potentially sensitive off-grid communications without any access control, minimization, or explicit user consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script persists mesh message contents, including sender/channel metadata, to a plaintext log file in /tmp without any access-control hardening, retention limits, or user disclosure. In this skill context, messages may contain sensitive off-grid communications such as emergencies or location-related content, so local logging increases confidentiality risk and leaves recoverable artifacts for other local users or processes.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script establishes outbound MQTT connections to external brokers automatically at startup using configured credentials, but there is no user-facing notice or confirmation that data will be transmitted off-device. In this skill context, silent network transmission is dangerous because users may reasonably expect only local radio messaging rather than cloud-mediated collection and publication.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Enable and start
sudo systemctl daemon-reload
sudo systemctl enable meshtastic-bridge
sudo systemctl start meshtastic-bridge

# Check status

• Confidence: 74% confidence
• Finding: systemctl enable

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.