T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:100
- Finding
- Externally Hosted Web Application Is Granted Broad Control Over a USB-Connected Device## Vulnerability Details **File Location**: `SKILL.md`, lines 100–106 **Vulnerability Type**: Excessive device privileges granted across an external trust boundary **Risk Level**: High ### Vulnerable Segment The following is an English rendering of the complete relevant segment: ```markdown ### 2. Open the Mobile AI Agent page Visit https://mobile-ai-use.com/mobileAi. The **Relay** indicator in the upper-right corner of the page turns green when the connection is successful. ### 3. Connect the phone Connect an Android device through USB. The page displays "Connected." ``` ### Technical Analysis The documented installation process instructs the user to load an externally hosted web application and then connect a real Android device to that page through USB. According to the rest of the skill documentation, the application uses WebADB and can inspect the device screen, open applications, tap interface elements, enter text, send messages, change settings, delete data, and conduct multi-step tasks. This architecture places a dynamically delivered external web origin inside a highly privileged device-control trust boundary. The code served by that origin is not included in the audited artifact and can change independently after the skill has been reviewed. Likewise, the referenced MCP server implementation is absent, so the audit cannot verify whether the server enforces authentication, origin restrictions, per-action authorization, or privilege separation. The written safety guidance asks the agent to obtain confirmation before sensitive actions, but no auditable implementation is supplied to demonstrate that this requirement is technically enforced. Advisory instructions alone do not prevent the external application or a compromised delivery path from issuing unauthorized WebADB operations after device access has been granted. ### Attack Path 1. A user follows `SKILL.md` and opens `https://mobile-ai-use.com/mobileAi`. ...[truncated 1860 chars]
- Remediation
- ## Remediation Suggestions 1. Ship the browser application and MCP server as auditable source code within the project rather than requiring a mutable external web origin. 2. Serve the control interface locally or distribute a versioned, signed build whose integrity can be verified before execution. 3. Pin all third-party dependencies with a lockfile and use integrity verification, dependency review, and reproducible builds. 4. Enforce strict origin validation and authenticated sessions on the local relay. Do not accept device-control requests merely because they originate from a process on the local machine. 5. Separate read-only capabilities, such as screenshots and device status, from write capabilities such as taps, text entry, deletion, messaging, settings changes, and purchases. 6. Implement mandatory, independently enforced user confirmation immediately before every high-impact action. Bind confirmation to the exact operation, target, content, and transaction amount. 7. Require renewed confirmation before retrying failed financial, messaging, deletion, or irreversible operations. 8. Deny sensitive operations by default and use narrowly scoped allowlists for applications and action types. 9. Display a persistent indicator while device control is active and provide an immediate local revocation mechanism that terminates the relay and releases USB access. 10. Include the referenced `mcp-server` source, manifests, lockfiles, and build configuration in future audit artifacts so authentication, authorization, origin handling, and data flows can be verified.