ClawHub
Back to skill

Security audit

Phone Controller | 手机操控者

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Android phone-control setup, but it asks users to install and trust unverified third-party components that can control a phone and handle sensitive input.

Install only if you are comfortable giving the setup ADB-level control of an Android device and sending screen contents to the GLM API. Use a test phone without sensitive accounts, pin and review the Open-AutoGLM revision before installing, verify any APK by hash and signing certificate, avoid entering API keys directly on the command line, and disable USB debugging plus switch back from ADB Keyboard immediately after use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:58
Finding

Unpinned Third-Party Code Is Downloaded and Installed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-69
Vulnerability Type: Unpinned third-party dependency and mutable upstream source
Risk Level: High

bash
**Clone project**
```bash
git clone https://github.com/zai-org/Open-AutoGLM.git \
  ~/.openclaw/workspace/projects/phone-controller/Open-AutoGLM

Install Python dependencies

bash
cd ~/.openclaw/workspace/projects/phone-controller/Open-AutoGLM
python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
.venv/bin/pip install -e .
text

### Technical Analysis

The deployment procedure clones the mutable default branch of an external repository without pinning it to a reviewed commit or signed release. It then processes the repository's dependency manifest and installs the repository itself in editable mode.

Package installation can execute package build hooks and other attacker-controlled installation logic. Because neither the repository revision nor dependency hashes are fixed, the code executed by a future installation can differ from the code reviewed during this audit. The document later recommends pinning a revision, but the operative installation commands do not implement that control.

### Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or one of its unresolved dependencies.
2. The attacker adds malicious installation logic or changes a dependency reference on the default branch.
3. A user follows the documented `git clone` command and receives the modified content.
4. The user runs `pip install -r requirements.txt` or `pip install -e .`.
5. Attacker-controlled package or build logic executes with the privileges of the user running the installation.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. This may permit access to that user's files, environment variables, API credentials, ADB connecti
...[truncated 259 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin Open-AutoGLM to a specifically reviewed commit hash or a signed, immutable release tag.
  • Verify the downloaded revision before installation, including its commit signature where available.
  • Replace unconstrained requirements with a lock file containing exact versions and cryptographic hashes.
  • Install dependencies with hash enforcement, such as pip install --require-hashes.
  • Review package build configuration and installation hooks before execution.
  • Avoid editable installation in production deployment.
  • Run installation and execution in an isolated, unprivileged environment with restricted filesystem and network access.
  • Update the documented commands so that revision and integrity verification are mandatory rather than advisory.

T08 · Insecure Dependencies

Error
Location
SKILL.md:84
Finding

Privileged Keyboard APK Is Obtained from a Mutable, Unverified Source

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84-90
Vulnerability Type: Unverified third-party Android component
Risk Level: High

text
**3. Install and enable ADB Keyboard**
- Download ADBKeyboard.apk: https://github.com/senzhk/ADBKeyBoard/blob/master/ADBKeyboard.apk
- After installation: Settings → System → Languages and input → Keyboard → Enable ADB Keyboard
- Set it as the default input method

Technical Analysis

The instructions obtain an APK through a mutable branch path and direct the user to enable it as the default input method. No immutable release identifier, expected SHA-256 digest, or expected signing-certificate fingerprint is provided.

An Android input method occupies a security-sensitive position because it can receive or manipulate text entered while active. A general recommendation elsewhere in the document to verify APK integrity is insufficient because no trusted expected value is supplied against which the artifact can be checked.

Attack Path

  1. An attacker compromises the upstream repository or its maintainer account and replaces the APK at the mutable branch path.
  2. A user follows the documented link and downloads the substituted APK.
  3. The user installs the APK and enables it as an Android input method.
  4. The user sets the component as the default keyboard as instructed.
  5. The malicious input method observes, modifies, or forwards input handled while it is active.

Impact Assessment

Exploitation could expose text entered through the malicious keyboard, including messages, search terms, personal information, and potentially credentials if the keyboard remains enabled on sensitive screens. It could also alter commands or messages before submission. The scope primarily covers the connected Android device and the data processed while the malicious input method is active; additional effects would depend on permissions and malicious behavior implemented ...[truncated 11 chars]

Remediation
View remediation

Remediation Suggestions

  • Distribute or reference a versioned, immutable release instead of a mutable branch artifact.
  • Publish an expected SHA-256 digest and require verification before installation.
  • Publish and verify the expected Android signing-certificate fingerprint.
  • Prefer an artifact built reproducibly from a reviewed source revision.
  • Do not instruct users to retain the keyboard as the default input method beyond the required automation session.
  • Explicitly require switching back to the original keyboard and disabling or uninstalling ADB Keyboard immediately after use.
  • Use a dedicated test device without sensitive accounts or personal data.
  • Prevent the input method from being used on login, payment, banking, password, and private communication screens.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:103
Finding

API Key Is Passed Through a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-112
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

bash
python main.py \
  --base-url https://open.bigmodel.cn/api/paas/v4 \
  --model "autoglm-phone" \
  --apikey "YOUR_API_KEY" \
  --max-steps 50 \
  "YOUR_INSTRUCTION"

Technical Analysis

The documented invocation places the GLM API key directly in a command-line argument. When a user substitutes a real key, it may be recorded in shell history. Depending on the operating system and process-inspection controls, command-line arguments may also be visible to other local users, monitoring agents, diagnostic utilities, process collectors, or logs.

Although the shown value is a placeholder rather than a hardcoded live credential, the prescribed secret-handling mechanism is insecure.

Attack Path

  1. A user replaces the placeholder with a valid API key and executes the documented command.
  2. The full command is retained in shell history, captured by terminal logging, or exposed through process metadata while the command is running.
  3. A local user, support bundle, monitoring process, or other party with access to that data retrieves the key.
  4. The exposed key is used to make unauthorized requests to the external API until it is revoked or expires.

Impact Assessment

An attacker obtaining the key could consume API quota, incur charges, access API capabilities granted to the credential, and cause activity to be attributed to the victim's account. The issue does not by itself grant Android or host-system privileges; its direct scope is the external API account and permissions associated with the exposed key.

Remediation
View remediation

Remediation Suggestions

  • Remove the --apikey command-line example.
  • Read the key from an interactive hidden prompt, an operating-system credential store, or a permission-restricted secret file.
  • If environment variables are supported, ensure they are not printed, logged, committed, or included in diagnostic output.
  • Restrict any secret file to the owning user, for example with mode 0600.
  • Configure the application to redact credentials from errors, traces, and debug logs.
  • Advise users who already followed the command-line example to remove the command from shell history and rotate the exposed key.
  • Apply provider-side usage limits, least-privilege scopes, expiration, and anomaly monitoring where supported.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes broad natural-language commands such as sending messages and ordering food without strong trigger boundaries, app scoping, or hard technical enforcement in the skill spec itself. In a phone-control context, ambiguous invocation can lead to unintended real-world actions on a connected device, especially because the skill can navigate apps and perform user-impacting operations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

安装 ADB（Linux/macOS）

bash
# Linux
sudo apt install android-tools-adb

# macOS
brew install android-platform-tools

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The FAQ states that ADB Keyboard only supports English/numbers and that Chinese input will be handled by other phone input methods, while the rest of the skill is documented around Chinese-language commands and app names. This creates a language/locale constraint in the skill behavior without an explicit user opt-in or a clear language selection mechanism.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.