ClawHub
Back to skill

Security audit

Tesla China

Security checks for vulnerabilities and agentic risk

Overview

This Tesla remote-control skill is mostly coherent, but it routes vehicle credentials and commands through a third-party service with under-disclosed high-impact access.

Only install this if you intentionally trust tesla.dhuar.com with Tesla vehicle access, VINs, telemetry, and command traffic. Treat the stored apiKey as a sensitive vehicle-control secret, restrict file permissions manually, avoid using command-line history for the key, and prefer a version that uses official Tesla authorization directly or clearly documents the proxy operator and safety controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

other

Error
Location
scripts/tesla-command.js:18
Finding

Sensitive vehicle credentials and control traffic routed through an undisclosed third-party proxy

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/tesla-command.js:153
Finding

API credential transmitted in URL query strings

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/init-tesla-config.js:64
Finding

Plaintext API key stored without explicitly restrictive file permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documentation claims the skill is based on Tesla's official Fleet API, but it instructs users to obtain an apiKey from the third-party domain tesla.dhuar.com and notes local reading of ~/.tesla_cn.json, with the key attached to requests. That mismatch is security-relevant because users may believe they are trusting Tesla directly while actually disclosing credentials and vehicle-control capability to an intermediary service, which could expose location, vehicle metadata, and remote command authority.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill exposes code capabilities that use local secrets and network access, but it does not declare any tool scope such as permissions or allowed-tools. This weakens user and platform visibility into what the skill can access, increasing the chance that a user will invoke a remote-control skill without understanding it can read ~/.tesla_cn.json and contact external services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script includes Chinese-only usage/documentation comments and Chinese user-facing output strings later in the file, indicating a fixed language choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

This appears to be a duplicate of the same session-persistence finding: the script writes a sensitive API key to ~/.tesla_cn.json in plaintext. In the context of a remote vehicle-control skill, credential exposure is more serious because the stored secret may enable access to Tesla account/vehicle operations if the local machine is compromised or shared.

Content

Scanner excerpt · scripts/init-tesla-config.js (reported line 79)May include surrounding context.

js
});
  } catch (e) {
    console.error('error');
    console.error('failed to write config file');
    console.log(
      JSON.stringify({
        error: 'write_failed',

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

This appears to be a duplicate of the same session-persistence finding: the script writes a sensitive API key to ~/.tesla_cn.json in plaintext. In the context of a remote vehicle-control skill, credential exposure is more serious because the stored secret may enable access to Tesla account/vehicle operations if the local machine is compromised or shared.

Content

Scanner excerpt · scripts/init-tesla-config.js (reported line 79)May include surrounding context.

js
});
  } catch (e) {
    console.error('error');
    console.error('failed to write config file');
    console.log(
      JSON.stringify({
        error: 'write_failed',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code loads an API key from a local config file and appends it to the request URL as a query parameter sent to a third-party proxy domain. Putting secrets in URLs is dangerous because they may be exposed through logs, browser/history equivalents, proxy logs, monitoring systems, referrer leakage, or error reporting, and the use of a non-official intermediary materially increases the trust and exfiltration risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script directly executes sensitive Tesla vehicle control commands such as locking doors, opening trunks, climate control, and boombox actions as soon as it is invoked. In a remote-control skill context, lack of an explicit confirmation or safety interlock increases the risk of accidental, spoofed, or unintended physical-world actions against a vehicle.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script's inline instructions and at least one user-facing error message are presented in Chinese only, which imposes a specific language on users without opt-in or alternative locale support. This can violate language/locale policy when the skill does not document that it is intentionally region-specific.

Content

No source excerpt is available for this finding.