Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Android automation guide for booking 12306 train tickets, with real risks from phone control and personal-data screenshots but no hidden or malicious behavior found.
Install only if you want an agent to control a USB-connected Android device for 12306 ticket booking. Keep login and payment manual, require confirmation before order submission, avoid placing secrets on the device clipboard, and treat screenshots/OCR output as potentially containing personal travel data.
The manifest description states that the skill handles Chinese-specific input and UI flows, including "clipboard Chinese input" and examples entirely tied to the 12306 Chinese rail app context. This indicates a language/locale constraint in the skill description without offering user choice or explicitly documenting the locale limitation as a justified regional constraint.
This helper executes arbitrary ADB shell commands passed in through the public shell(cmd) method with no validation or allowlisting. While subprocess.run is invoked without a local shell, the string is still executed by the device-side adb shell interpreter, so any untrusted input reaching cmd can trigger unintended actions on the connected Android device.
self._prefix = ["adb"] + (["-s", device] if device else [])
def shell(self, cmd: str, timeout: int = 30) -> str:
r = subprocess.run(self._prefix + ["shell", cmd],
capture_output=True, text=True, timeout=timeout)
return r.stdout.strip()
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def dump_ui(self) -> str:
self.shell("uiautomator dump /sdcard/ui_dump.xml")
subprocess.run(self._prefix + ["pull", "/sdcard/ui_dump.xml", "/tmp/adb_ui.xml"],
capture_output=True, text=True, timeout=15)
with open("/tmp/adb_ui.xml") as f:
return f.read()
The adb pull destination path is caller-controlled via screenshot(path=...), allowing arbitrary file overwrite on the local host process context if an untrusted caller supplies a sensitive path or symlink target. In an agent or automation environment, this can be abused to clobber files accessible to the running user.
def screenshot(self, path: str = "/tmp/adb_screenshot.png"):
self.shell("screencap -p /sdcard/adb_scr.png")
subprocess.run(self._prefix + ["pull", "/sdcard/adb_scr.png", path],
capture_output=True, text=True, timeout=10)
return path
Copying caller-provided text to the device clipboard can expose sensitive data to other apps, keyboard services, clipboard managers, or later user actions on the device. Because the method performs this silently and leaves clipboard state altered, secrets such as credentials or PII may be disclosed beyond the intended text field.
The natural-language instructions repeatedly frame text entry around Chinese input and later reference tapping the Chinese paste label 粘贴, which suggests a locale-specific interaction model. There is no indication that the skill adapts to other device languages or offers a language/locale choice, which can violate a language neutrality policy.
No suspicious patterns detected.