ClawHub
Back to skill

Security audit

Tesla Skill

Security checks for vulnerabilities and agentic risk

Overview

This Tesla control skill is mostly clear about its purpose, but it asks users to run an unverified remote installer and enables real vehicle actions without explicit confirmation safeguards.

Review the installer source and prefer a pinned, checksum-verified release before installing. Only use this skill if you are comfortable granting an agent access to Tesla OAuth credentials and real vehicle controls, and require explicit confirmation before any command that unlocks, honks, changes climate, or controls charging.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

yaml
install:
  - kind: shell
    cmd: "curl -fsSL https://raw.githubusercontent.com/Agent-Gen-com/tesla-cli/main/install.sh | sh"
    bins: [teslacli]

The same installation command is repeated in the user-facing installation instructions at line 33:

sh
curl -fsSL https://raw.githubusercontent.com/Agent-Gen-com/tesla-cli/main/install.sh | sh

Technical Analysis

The installation process downloads install.sh from the mutable main branch of an external GitHub repository and pipes its contents directly into sh. No immutable commit, release version, cryptographic signature, or checksum is specified. The downloaded content is also not saved for inspection before execution.

Consequently, the effective code executed during installation can differ from the content available when this Skill was reviewed. Compromise of the repository, its maintainer account, GitHub delivery infrastructure, or the referenced branch could substitute arbitrary shell commands. Those commands execute with all permissions available to the user installing the Skill.

Downloading an installer is relevant to the declared need to install teslacli, but direct execution of an unpinned and unverified remote script is not the minimum privilege or minimum trust approach required for that purpose. The project contains only SKILL.md, so the actual installer and installed CLI behavior cannot be statically verified from the audited artifact.

Attack Path

  1. An attacker compromises the external repository, a maintainer account, or another component capable of changing the main branch's install.sh.
  2. The attacker adds arbitrary shell commands to the installer.
  3. A user or agent installs the Skill through its metadata command or follows the documented instal ...[truncated 1402 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | sh installation pattern from both Skill metadata and documentation.
  2. Reference an immutable, reviewed release version or commit rather than the mutable main branch.
  3. Download the installer or release artifact to a local file without executing it immediately.
  4. Publish and verify a SHA-256 checksum and, preferably, a cryptographic signature from a separately protected signing key.
  5. Abort installation on any signature, checksum, platform, or expected-file mismatch.
  6. Allow the installer content to be inspected before execution and document exactly which files and directories it modifies.
  7. Avoid elevated privileges; install only into a user-scoped directory unless the user explicitly approves a justified privileged operation.
  8. Prefer a trusted package manager or bundle reviewed installation code with the Skill so its behavior is covered by the same audit.
  9. Pin all binaries and transitive components installed by the script, and provide reproducible build information or provenance attestations.
  10. Perform a separate security review of install.sh and the resulting teslacli executable before granting them access to Tesla credentials or vehicle-control authorization.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The use of '| sh' executes untrusted remote content immediately without validation, making it a direct command-chaining abuse vector. In this skill, the danger is elevated because installation occurs before any Tesla-related safeguards apply, so a compromised installer could steal environment variables such as AGENTGEN_API_KEY, read local files, or establish persistence.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Installation

sh
curl -fsSL https://raw.githubusercontent.com/Agent-Gen-com/tesla-cli/main/install.sh | sh

Supports macOS (Intel & Apple Silicon) and Linux (x86_64 & ARM64).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes real-world vehicle control actions such as unlock, honk, flash, climate, and charging commands without requiring explicit user confirmation or warning about physical-world consequences. In an agent context, this increases the chance of unsafe or unauthorized actuation, especially if commands are triggered from ambiguous prompts or chained workflows.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The install metadata directs the agent to fetch and execute a remote shell script directly from GitHub using curl-pipe-to-shell. This creates a supply-chain risk: if the upstream repository, network path, or referenced script changes or is compromised, arbitrary code can run on the host during skill installation.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
- teslacli
    install:
      - kind: shell
        cmd: "curl -fsSL https://raw.githubusercontent.com/Agent-Gen-com/tesla-cli/main/install.sh | sh"
        bins: [teslacli]
---

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The installation instructions repeat a curl-pipe-to-shell pattern for a remote installer script. Even if intended for convenience, this encourages unsafe operator behavior and allows arbitrary code execution if the remote content is modified or intercepted.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Installation

sh
curl -fsSL https://raw.githubusercontent.com/Agent-Gen-com/tesla-cli/main/install.sh | sh

Supports macOS (Intel & Apple Silicon) and Linux (x86_64 & ARM64).

Static analysis

No suspicious patterns detected.