T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
bin/tesla-control.py:52- Finding
Undocumented Destructive Charge-Schedule Removal Command
- Content
View full analysis
- Remediation
View remediation
Security audit
Tesla Commands
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but it can change a real vehicle's state and includes an undocumented command that deletes charging schedules without confirmation.
Review this carefully before installing. Only use it with a MyTeslaMate token you are comfortable granting vehicle-control authority to, avoid letting agents run state-changing commands automatically, and treat schedule deletion, charge-limit changes, climate control, and wake actions as requiring explicit user confirmation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
bin/tesla-control.py:50- Finding
Missing Range Validation for Safety-Relevant Vehicle Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tainted flow: 'req' from os.environ.get (line 28, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, headers=headers, method=method) if data is not None: body = json.dumps(data).encode('utf-8') with urllib.request.urlopen(req, data=body) as response: return json.loads(response.read().decode()) else: with urllib.request.urlopen(req) as response:
Tainted flow: 'req' from os.environ.get (line 28, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python with urllib.request.urlopen(req, data=body) as response: return json.loads(response.read().decode()) else: with urllib.request.urlopen(req) as response: return json.loads(response.read().decode()) except urllib.error.HTTPError as e: try:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares no explicit tool scope even though its documented behavior depends on environment variables and network access. In a skill that can remotely control a real vehicle, missing permission boundaries increases the chance of unintended capability exposure, confused-deputy behavior, or use in contexts where operators do not realize the skill can access secrets and perform outbound control actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation advertises remote vehicle-control operations such as wake, climate changes, and charging schedule updates without any safety warnings, confirmation guidance, or mention of real-world consequences. Because these actions affect a physical asset, omission of operational safety context can lead to accidental activation, misuse by an uninformed operator, or automation that changes vehicle state at inappropriate times.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # Configuration should come from Environment Variables TOKEN = os.environ.get("TESLA_MATE_TOKEN") DEFAULT_VIN = os.environ.get("TESLA_VIN") API_BASE = "https://api.myteslamate.com/api/1/vehicles" def call_api(path, method="GET", data=None, vin=None): if not TOKEN:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python req = urllib.request.Request(url, headers=headers, method=method) if data is not None: body = json.dumps(data).encode('utf-8') with urllib.request.urlopen(req, data=body) as response: return json.loads(response.read().decode()) else: with urllib.request.urlopen(req) as response:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script exposes state-changing vehicle commands such as wake, climate control, charge-limit changes, and schedule removal without any confirmation, dry-run mode, or user-facing warning. In an agent skill context, this increases the risk of accidental or prompt-induced execution that can directly alter vehicle behavior, making the operational context more dangerous than a typical local CLI utility.
- Content
Static analysis
No suspicious patterns detected.