Security audit

Tesla

Security checks across malware telemetry and agentic risk

Overview

This Tesla skill appears purpose-built for vehicle control, but it needs review because it can affect a real car, reveal precise location, and store access tokens locally without enough guardrails.

Install only if you are comfortable letting the agent access and control your Tesla account. Use it on a trusted machine, verify which vehicle is targeted before any action, treat location output as private, and revoke/remove the local Tesla token cache if you stop using the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The documented behavior does not fully match the described purpose: the skill advertises Fleet API use while also referencing an unofficial Tesla Owner API, and it exposes additional actuator actions like honk and flash. This can mislead users and reviewers about what systems and commands are actually being used, increasing the risk of unauthorized or unexpected vehicle actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README prominently advertises remote actions such as unlock, climate control, charging, and vehicle location without any explicit warning about real-world consequences or the sensitivity of these capabilities. In an agent-integrated skill, this can normalize high-impact commands and increase the chance of accidental, unauthorized, or insufficiently confirmed execution against a physical asset.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The example chat phrases are broad natural-language triggers for sensitive physical actions such as locking, climate control, and honking. Without explicit invocation constraints or confirmation requirements, an agent could map ambiguous user text directly to real-world vehicle commands, causing unintended actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Defaulting commands to the first vehicle without a prominent warning is dangerous in a multi-vehicle control skill. A user may believe they are operating on a named vehicle, while the system silently applies lock, unlock, climate, charge, or location actions to a different car.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The location command retrieves and prints precise vehicle coordinates and a maps URL without any privacy warning, confirmation step, or output minimization. In the context of a vehicle-control skill, precise live location is highly sensitive telemetry and can expose user movements or home/work locations if run in shared terminals, logs, or agent environments.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script caches Tesla authentication material to a predictable file in the user's home directory without clearly warning the user or enforcing restrictive permissions. If the host is shared, compromised, or backups/logging expose the file, an attacker may gain long-lived access to vehicle telemetry and remote control functions such as unlock, climate, or charging actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.