Security audit

Carrera HYBRID BLE Controller

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about controlling a Carrera HYBRID BLE RC car, but it needs Review because physical control and MITM sniffing are under-scoped and the drive script lacks basic safety limits.

Install only if you own or are authorized to test the car, run it in a controlled physical space, pin dependencies in a virtual environment, set conservative gas and duration limits, and add a best-effort stop/finally handler before exposing it through Telegram or any remote interface.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party BLE Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/carrera_drive.py:69
Finding: Unvalidated Vehicle Controls and Missing Guaranteed Stop Sequence
Content: View full analysis
2 else 40 dur = int(sys.argv[3]) if len(sys.argv) > 3 else 3000 ``` The final stop is executed only on the normal completion path and is not protected by `try/finally`: ```python async with BleakClient(ADDRESS, timeout=15) as client: print(f"Connected! Command: {cmd}") if cmd == "forward": await drive_command(client, gas_val, 0, dur) elif cmd == "back": await drive_command(client, -gas_val, 0, dur) elif cmd == "left": await drive_command(client, gas_val, -100, dur) elif cmd == "right": await drive_command(client, gas_val, 100, dur) elif cmd == "spin": await drive_command(client, gas_val, -127, dur) elif cmd == "light_on": await drive_command(client, 0, 0, dur, light=True) elif cmd == "light_off": await drive_command(client, 0, 0, dur, light=False) elif cmd == "idle": await stop(client, dur) elif cmd == "demo": print("Forward...") await drive_command(client, 40, 0, 2000) await stop(client, 500) print("Left...") await drive_command(client, 40, -100, 2000) await stop(client, 500) print("Right...") await drive_command(client, 40, 100, 2000) await stop(client, 500) print("Back...") await drive_command(client, -40, 0, 2000) await stop(client, 500) else: print(f"Unknown command: {cmd}") return # Always end with idle await stop(client, 300) ``` Throttle generation wraps supplied values into one byt ...[truncated 2549 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is clearly related to Carrera HYBRID BLE car control, so the general domain is accurate. However, the declared description substantially overstates the implemented functionality. The supplied code only provides direct BLE transmission of precomputed control packets for simple movement and light control. It does not implement Telegram integration, inline buttons, MITM proxying, sniffing, logging, discovery, reverse-engineering workflows, or text/path drawing. Because several prominent declared capabilities are absent from the code chunk, the description does not accurately represent what this specific code actually does.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation text is broad enough that ordinary user requests about driving, steering, lights, or Bluetooth cars could trigger a skill that performs real-world hardware control and potentially reverse-engineering actions. Over-broad routing increases the chance of unintended invocation of BLE control or adjacent risky features without the user understanding the physical or privacy implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises MITM protocol sniffing and remote hardware control without a prominent warning that it can intercept BLE traffic and affect nearby physical devices. In a real environment, that can lead to unauthorized interception, device manipulation, or unsafe operation if users invoke these capabilities casually or against devices they do not own.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The Telegram remote control labels are shown only in German (for example, "Vorwärts," "Rückwärts," and "Licht AN") with no note that the language is configurable or intentionally region-specific. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.