T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:61- Finding
Unvalidated User-Controlled Values Are Used in Deployment and SSH Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
Teslamate Deploy
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent TeslaMate deployment purpose, but it asks for high-impact deployment authority while relying on missing scripts, weak/default secrets, exposed services, and loosely scoped shell/SSH commands.
Review this skill carefully before installing. It is not clearly malicious, but it performs a privileged server deployment for sensitive Tesla telemetry and leaves important hardening to the user. Only use it on a trusted host and network, verify the missing scripts before execution, generate strong unique secrets before first startup, restrict ports with a firewall or VPN, and never paste Tesla tokens into chat or terminal commands.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:116- Finding
Deployment Uses Intentionally Weak Default Secrets and Potentially Exposed Services
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
For remote: same but with ssh + curl-over-ssh, e.g.
ssh $ssh_user@$server_ip "curl -fsS -o /dev/null -w 'Grafana: %{http_code}\n' http://localhost:3000/api/health" ssh $ssh_user@$server_ip "cd /home/$ssh_user/teslamate && sudo docker compose ps"
text Pass criteria: Grafana returns 200, TeslaMate returns 200 (or 30x redirect), all 4 containers `Up`. If TeslaMate returns 503 / connection refused within 1–2 minutes, that's normal — the database is still initializing. Re-check after 90 seconds.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill explicitly directs access to a .env file that likely contains sensitive values such as TM_DB_PASS and TM_ENCRYPTION_KEY. Because this is a deployment/admin skill and the file is central to service operation, normalizing direct handling of plaintext secrets materially increases the chance of leakage through terminals, copied docs, backups, or shared sessions.
- Content
改默认密码 / 加密密钥
cd ~/teslamate # 远程是 /home/$ssh_user/teslamate sudo nano .env # 改完重启: sudo docker compose up -d
text ## 注意事项
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prescribed user-facing prompts are written as fixed Chinese text, and the skill later requires generating a Chinese usage document template. This imposes a specific language on the interaction without opt-in or an explicit user language preference, which violates the language/locale policy criteria.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill copies deployment assets into a predictable per-user directory under /tmp and runs from there, while also noting that .env and import data are written in the working directory. On many systems /tmp is shared and world-searchable, so using a stable path for secret-bearing deployment state increases the risk of local disclosure, tampering, or accidental persistence across runs.
- Content
md SKILL_DIR="$HOME/.workbuddy/skills/teslamate-deploy" # 临时拷贝到 ~/teslamate-deploy 一起执行 (install 脚本需要 docker-compose.yml 在同目录) WORK=/tmp/teslamate-deploy-$USER rm -rf "$WORK" && mkdir -p "$WORK" cp "$SKILL_DIR/scripts/"{deploy-setup.sh,install-teslamate.sh,docker-compose.yml} "$WORK/" chmod +x "$WORK/deploy-setup.sh" "$WORK/install-teslamate.sh" cd "$WORK"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
For remote: same but with ssh + curl-over-ssh, e.g.
ssh $ssh_user@$server_ip "curl -fsS -o /dev/null -w 'Grafana: %{http_code}\n' http://localhost:3000/api/health" ssh $ssh_user@$server_ip "cd /home/$ssh_user/teslamate && sudo docker compose ps"
text Pass criteria: Grafana returns 200, TeslaMate returns 200 (or 30x redirect), all 4 containers `Up`. If TeslaMate returns 503 / connection refused within 1–2 minutes, that's normal — the database is still initializing. Re-check after 90 seconds.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
For remote: same but with ssh + curl-over-ssh, e.g.
ssh $ssh_user@$server_ip "curl -fsS -o /dev/null -w 'Grafana: %{http_code}\n' http://localhost:3000/api/health" ssh $ssh_user@$server_ip "cd /home/$ssh_user/teslamate && sudo docker compose ps"
text Pass criteria: Grafana returns 200, TeslaMate returns 200 (or 30x redirect), all 4 containers `Up`. If TeslaMate returns 503 / connection refused within 1–2 minutes, that's normal — the database is still initializing. Re-check after 90 seconds.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs the agent to create a markdown file using a Chinese-only template, including headings and instructions, with no option to adapt to user language. That is a natural-language locale constraint applied by default rather than by user choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill goes beyond installation and explicitly instructs the operator to obtain and paste a Tesla refresh token into TeslaMate. That extends the skill into handling a high-value account credential, increasing the chance of credential exposure through logs, screenshots, shell history, copied output, or operator confusion about where the token should be entered.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo docker compose ps # 看 TeslaMate 实时日志 sudo docker compose logs -f teslamate # 改默认密码 / 加密密钥 cd ~/teslamate # 远程是 /home/$ssh_user/teslamate
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 81% confidence
- Finding
Instructing the operator to open the deployment .env file with sudo exposes secrets such as database passwords and encryption keys during routine workflow. In the context of this skill, the .env contains intentionally weak defaults, so steering users into direct secret handling without a safer secret-rotation procedure increases the risk of credential disclosure and accidental persistence of insecure values.
- Content
改默认密码 / 加密密钥
cd ~/teslamate # 远程是 /home/$ssh_user/teslamate sudo nano .env # 改完重启: sudo docker compose up -d
text ## 注意事项
Static analysis
No suspicious patterns detected.