ClawHub
Back to skill

Security audit

Appium Android Adb

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Android automation bridge with sensitive capabilities, but its behavior fits its stated purpose and includes user-control guidance.

Install this only if you want an agent to control a connected Android device. Treat screenshots, OCR output, accessibility trees, and clipboard text as sensitive; keep payment credentials user-entered only, require confirmation for purchases or account changes, and stop the Appium bridge daemon after use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The OCR tap routine references 'driver.execute_script(...)' without ever obtaining a driver instance, causing a runtime failure instead of performing the intended action. In a device-control daemon, broken control paths can leave automation in an inconsistent state and may encourage unsafe operator workarounds such as repeated retries or manual intervention on sensitive screens.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This command captures the full device screen and persists it locally under a predictable filename, which may expose credentials, personal data, payment details, or one-time codes visible on the handset. In the context of a persistent automation bridge for a ticketing/mobile app, screenshots are especially sensitive because they can contain account and travel information from real user sessions.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The OCR workflow captures and stores full-screen images for text extraction, creating local copies of potentially sensitive device contents without a clear consent or retention model. Because this bridge automates a consumer app and may operate on booking/payment screens, the stored screenshots materially increase privacy and data-exposure risk.

Session Persistence

Medium
Category
Rogue Agent
Content
# 5. Start daemon (pre-warms session)
rm -f ~/.cache/appium-bridge/bridge_cmd ~/.cache/appium-bridge/bridge_resp
python3 ~/.openclaw/workspace/skills/appium-android-adb/bridge_daemon.py --daemon &
sleep 6  # Wait for daemon to create session

# 6. Test daemon with a quick dump
RESP=$(python3 ~/.openclaw/workspace/skills/appium-android-adb/bridge_daemon.py dump 2>/dev/null)
Confidence
74% confidence
Finding
The script intentionally pre-warms and retains an Appium/bridge session, which creates persistent access to the connected Android device beyond a single explicit user action. In a skill context, that persistence increases the blast radius of any later misuse of the bridge daemon, because future commands can interact with the device without re-establishing trust or requiring fresh operator confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content
export ANDROID_HOME="${ANDROID_HOME:-$HOME/android-sdk}"
    # No insecure features needed — the daemon only uses standard UiAutomator2
    # commands (find/click, mobile: clickGesture/scrollGesture).
    nohup appium --log "$HOME/.cache/appium-bridge/appium.log" > /dev/null 2>&1 &
    sleep 4
fi
Confidence
70% confidence
Finding
Starting Appium with nohup in the background creates a long-lived service that may continue accepting automation requests after the invoking shell exits. In combination with a connected device and the later bridge daemon, this persistence can enable unintended or unauthorized continued device control if local access to the host is obtained or if the service is reused implicitly.

Static analysis

No suspicious patterns detected.