ClawHub
Back to skill

Security audit

Off-grid radio for sovereign AI. LoRa mesh comms via Meshtastic — no internet required.

Security checks for vulnerabilities and agentic risk

Overview

The skill fits Meshtastic messaging overall, but needs Review because it can automatically publish location/device metadata and persist or forward mesh traffic in ways the docs understate.

Install only after reviewing the code and configuration carefully. Disable map publishing in code before running, avoid sending sensitive messages or precise locations, use a private log directory with restrictive permissions, prefer group-based serial access over chmod 666, and treat all received mesh/MQTT text as untrusted external content before forwarding or acting on it.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mqtt_bridge.py:36
Finding

Location and Device Metadata Publishing Is Enabled by Default

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mqtt_bridge.py:29
Finding

MQTT Credentials and Sensitive Traffic Are Transmitted Without TLS

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mqtt_bridge.py:89
Finding

Predictable Shared Temporary Files Permit Local Disclosure and Symlink Attacks

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/SETUP.md:63
Finding

Setup Guide Grants Every Local User Read/Write Access to the Radio Device

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/SETUP.md:27
Finding

Installation Uses Unpinned Third-Party Dependencies Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mqtt_bridge.py:113
Finding

Attacker-Controlled Mesh Messages Can Become Indirect Agent Instructions

Content
View full analysis
1: channel = topic.split('/')[-2] if '/' in topic else 'unknown' dist = get_distance_str(sender) log.info(f"💬 [{channel}] {sender} ({dist}): {text}") with open('/tmp/mesh_messages.txt', 'a') as f: f.write(f"{datetime.utcnow().isoformat()}|{channel}|{sender}|{dist}|{text}\n") ``` ```python elif name == "mesh_messages": limit = arguments.get("limit", 20) since = arguments.get("since_minutes") do_filter = arguments.get("filter_noise", True) messages = read_messages(limit=limit * 2, since_minutes=since) if do_filter: messages = filter_noise(messages) messages = messages[-limit:] if not messages: return [TextContent(type="text", text="No messages found")] lines = [f"[{m['timestamp']}] {m['sender']} ({m['distance']}): {m['text']}" for m in messages ...[truncated 2916 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (57)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 211)May include surrounding context.

md
**Messaging** (via bridge):
| Tool | Description |
|------|-------------|
| `mesh_send` | Send message to mesh (broadcast or DM) |
| `mesh_send_alert` | Send high-priority alert message |
| `mesh_messages` | Get recent messages with filtering |

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill is presented as LoRa messaging, but the architecture also includes external MQTT ingestion of global traffic, optional map publishing, local file persistence, node-position caching, and a command socket on localhost:7331. These materially expand the privacy and attack surface beyond simple off-grid messaging, especially because users may not realize that internet-connected MQTT and local command/control are part of the design.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill is presented as LoRa messaging, but the architecture also includes external MQTT ingestion of global traffic, optional map publishing, local file persistence, node-position caching, and a command socket on localhost:7331. These materially expand the privacy and attack surface beyond simple off-grid messaging, especially because users may not realize that internet-connected MQTT and local command/control are part of the design.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill is presented as LoRa messaging, but the architecture also includes external MQTT ingestion of global traffic, optional map publishing, local file persistence, node-position caching, and a command socket on localhost:7331. These materially expand the privacy and attack surface beyond simple off-grid messaging, especially because users may not realize that internet-connected MQTT and local command/control are part of the design.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill is presented as LoRa messaging, but the architecture also includes external MQTT ingestion of global traffic, optional map publishing, local file persistence, node-position caching, and a command socket on localhost:7331. These materially expand the privacy and attack surface beyond simple off-grid messaging, especially because users may not realize that internet-connected MQTT and local command/control are part of the design.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The instruction to use chmod 666 is an unsafe parameter choice for a privileged tool because it grants universal read/write access to a hardware device. This is dangerous because it turns a permission issue into a broad local compromise of device control rather than solving access with least privilege.

Content

Scanner excerpt · references/SETUP.md (reported line 70)May include surrounding context.

Permission denied:

bash
sudo chmod 666 /dev/ttyACM0
# Or add udev rule for permanent fix

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The configuration enables receipt of global Meshtastic MQTT traffic by default and includes real broker credentials, but it does not clearly warn that this may ingest third-party mesh messages and associated metadata. In a messaging skill, this creates a meaningful privacy and compliance risk because operators may unknowingly collect or process non-local communications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The alert forwarding section allows mesh-derived message content or metadata to be sent to third-party services such as Telegram or Discord without an explicit warning about external disclosure. In this skill's context, forwarding radio network data off-device can expand exposure beyond the local mesh and surprise users who expect communications to remain confined to their node or network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README prominently advertises global MQTT traffic and local logging to /tmp/mesh_messages.txt without an equally explicit warning that messages may be publicly relayed and stored in a world-readable or ephemeral location depending on host configuration. In a messaging skill, this can lead users or downstream agents to handle sensitive data under false assumptions of privacy, causing inadvertent data exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill describes shell commands, file access, temp-file logging, and local service control, but it declares no explicit tool scope or permission boundaries. In an agent environment, this under-specification can cause the skill to be invoked with broader host access than users expect, increasing the chance of unintended file reads/writes or command execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

md
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/SETUP.md (reported line 317)May include surrounding context.

md
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/SETUP.md (reported line 318)May include surrounding context.

md
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/SETUP.md (reported line 319)May include surrounding context.

md
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/mesh.py (reported line 204)May include surrounding context.

python
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/mesh.py (reported line 217)May include surrounding context.

python
sudo systemctl status meshtastic-bridge

# Restart
sudo systemctl restart meshtastic-bridge

# View logs
sudo journalctl -u meshtastic-bridge -f

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The monitoring examples instruct the agent to read mesh messages, summarize them, translate them, and deliver alerts over external channels such as Telegram, but the warning about privacy exposure is limited and not tied directly to forwarding content off-device. That can result in sensitive radio traffic, identifiers, or inferred location information being redistributed to third-party services without clear user acknowledgement.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · CONFIG.md (reported line 83)May include surrounding context.

  • Try different USB cable (must be data cable)
  • Try different USB port
  • Check dmesg | tail -20 for errors
  • Ensure user is in dialout group: sudo usermod -a -G dialout $USER

Permission denied:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

  • Try different USB cable (must be data cable)
  • Try different USB port
  • Check dmesg | tail -20 for errors
  • Ensure user is in dialout group: sudo usermod -a -G dialout $USER

Permission denied:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

  • Try different USB cable (must be data cable)
  • Try different USB port
  • Check dmesg | tail -20 for errors
  • Ensure user is in dialout group: sudo usermod -a -G dialout $USER

Permission denied:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/SETUP.md (reported line 66)May include surrounding context.

  • Try different USB cable (must be data cable)
  • Try different USB port
  • Check dmesg | tail -20 for errors
  • Ensure user is in dialout group: sudo usermod -a -G dialout $USER

Permission denied:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/SETUP.md (reported line 314)May include surrounding context.

  • Try different USB cable (must be data cable)
  • Try different USB port
  • Check dmesg | tail -20 for errors
  • Ensure user is in dialout group: sudo usermod -a -G dialout $USER

Permission denied:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/SETUP.md (reported line 322)May include surrounding context.

  • Try different USB cable (must be data cable)
  • Try different USB port
  • Check dmesg | tail -20 for errors
  • Ensure user is in dialout group: sudo usermod -a -G dialout $USER

Permission denied:

bash