ClawHub
Back to skill

Security audit

Phone Controller | 手机操控者

Security checks across malware telemetry and agentic risk

Overview

This skill clearly discloses phone automation, but it deserves Review because it asks users to grant broad ADB-level control to external, unpinned code and an APK while sending phone screenshots to a third-party API.

Install only if you are comfortable giving an agent ADB-level automation over a connected Android phone. Prefer a dedicated test device, pin and verify the external repository and APK before use, avoid banking, payment, password, and private-chat screens, confirm every write, purchase, settings, or delete action carefully, and revoke USB debugging plus remove ADB Keyboard when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The skill activation/use description is broad enough that an agent could invoke phone control for loosely related requests, which is especially risky because this skill can drive a real Android device via ADB. Over-broad invocation increases the chance of unintended app launches, navigation, data entry, message sending, or interaction with privacy-sensitive screens despite the documented cautions.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.