Mobilerun

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:43 AM UTC
• Version: 1.2.0

Overview

This skill is purpose-built for Android automation, but it asks users to trust a remote service and sideloaded accessibility app while under-disclosing device, screen, and credential exposure.

Install only if you are comfortable giving Mobilerun-mediated agent control over an Android device. Prefer a test phone or non-sensitive cloud device, avoid banking/password/MFA/confidential screens, do not paste API keys into chat, verify the APK source before sideloading, and revoke Accessibility permission or uninstall the Portal app when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: setup.md:66
• Finding: Unpinned Sideloaded APK Receives Privileged Accessibility Access<![CDATA[ ## Vulnerability Details **File Location**: `setup.md`, lines 66-75 **Vulnerability Type**: Untrusted and mutable software supply chain **Risk Level**: High ### Vulnerable Code Snippet ```markdown 1. On the Android device, go to **https://droidrun.ai/portal** -- this redirects to the latest GitHub release 2. Download the file named `droidrun-portal-vx.x.x.apk` (the version number varies) 3. Open/install the downloaded APK - Android may warn about installing from unknown sources -- the user needs to allow it #### Connecting to Mobilerun Once the Portal app is installed and opened: 1. **Grant accessibility permission**: A red banner at the top says "Accessibility Service Not Enabled" -- tap **"Enable Now"** and follow the system prompts to enable it. This Android system permission is required so the agent can read on-screen element names and positions (the UI accessibility tree). The permission is scoped to the Portal app only and does not grant access to other apps' data. The user controls when the connection is active. ``` ### Technical Analysis The installation procedure directs users through a mutable redirect to an unspecified “latest” GitHub release. It neither pins a specific release and repository nor provides an expected SHA-256 digest or Android signing-certificate fingerprint. The procedure also requires bypassing Android's unknown-source installation protection. After installation, the sideloaded application is granted Accessibility Service access, enabling extensive observation and interaction with the device UI. Consequently, the integrity of the privileged Android component depends on the continuing security of the redirect domain, DNS and TLS infrastructure, GitHub release account, release workflow, and uploaded artifact. A malicious replacement can be delivered without modifying the audited skill package. ### Attack Path 1. An attacker compromises the redirect endpoint, release repository, maintainer account, CI/CD release ...[truncated 1447 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Distribute the application through Google Play or another platform that provides authenticated publisher identity, signing enforcement, and update review. 2. If sideloading remains necessary, pin an exact version and canonical repository instead of redirecting to the mutable “latest” release. 3. Publish an expected SHA-256 digest for every APK and require users or installation tooling to verify it before installation. 4. Publish the expected Android signing-certificate SHA-256 fingerprint and document how to compare it with the downloaded APK. 5. Protect release publishing with hardware-backed multi-factor authentication, protected CI environments, least-privilege release tokens, and artifact provenance attestations. 6. Obtain explicit, informed user confirmation separately for unknown-source installation and Accessibility Service access. 7. Explain how users can disable the Accessibility Service, disconnect the application, and uninstall it after completing the task. 8. Minimize the Accessibility Service configuration to only the event types, packages, and capabilities strictly necessary for the requested operation. ]]>

other

Warning

• Location: setup.md:75
• Finding: Misleading Disclosure of Accessibility Scope and Remote Data Flow<![CDATA[ ## Vulnerability Details **File Locations**: - `setup.md`, line 75 - `SKILL.md`, lines 3-9 - Supporting behavior: `phone-api.md`, lines 62-164 **Vulnerability Type**: Misleading privacy and permission disclosure **Risk Level**: Medium ### Vulnerable Code Snippets `setup.md`, line 75: ```markdown 1. **Grant accessibility permission**: A red banner at the top says "Accessibility Service Not Enabled" -- tap **"Enable Now"** and follow the system prompts to enable it. This Android system permission is required so the agent can read on-screen element names and positions (the UI accessibility tree). The permission is scoped to the Portal app only and does not grant access to other apps' data. The user controls when the connection is active. ``` `SKILL.md`, lines 3-9: ```yaml description: > Give your OpenClaw agent hands on a real Android phone. Tap, swipe, type, take screenshots, read the UI accessibility tree, and manage apps — all through the official Mobilerun API (mobilerun.ai). Your agent can automate any Android app: social media, testing, data collection, or anything you'd do manually. Uses YOUR API key (stored securely via MOBILERUN_API_KEY env var) and YOUR device (personal phone via Portal APK or cloud device). No data leaves your control. ``` The documented API can retrieve screenshots and accessibility-tree fields such as: ```json { "focusedElement": { "className": "string", "resourceId": "string", "text": "string" } } ``` Accessibility nodes can also contain `text`, `contentDescription`, application package names, resource identifiers, element bounds, and interaction states. ### Technical Analysis The statement that Accessibility permission “does not grant access to other apps' data” is materially incomplete in the context of the documented functionality. The skill explicitly uses Accessibility to read on-screen text and element metadata and claims it can automate any Android application. Although this does ...[truncated 2252 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace “does not grant access to other apps' data” with an accurate explanation that Accessibility can observe and interact with accessible content displayed by other applications, while not inherently granting direct access to their private internal storage. 2. Remove the absolute statement “No data leaves your control.” 3. Document the complete data flow for screenshots, accessibility trees, device information, task trajectories, files, and credentials. 4. State whether data is transmitted through, processed by, logged on, or retained by Mobilerun infrastructure, including retention periods and deletion controls. 5. Link to an applicable privacy policy and data-processing terms before asking the user to grant Accessibility access. 6. Require explicit confirmation before observing sensitive screens, using stored credentials, submitting remote AI-agent tasks, or performing consequential actions. 7. Add guidance to avoid banking, password-manager, authentication, health, and confidential work screens unless strictly required and explicitly authorized. 8. Provide clear instructions for disconnecting the Portal, revoking Accessibility permission, deleting retained task artifacts, rotating API keys, and uninstalling the application. 9. Implement redaction or exclusion controls for password fields, notifications, authentication codes, and designated sensitive applications wherever technically possible. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Terminate a Cloud Device

```
DELETE /devices/{deviceId}
Content-Type: application/json

{}

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Clear Input

```
DELETE /devices/{deviceId}/keyboard
```

Clears the currently focused input field.

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Uninstall App

```
DELETE /devices/{deviceId}/apps/{packageName}
Content-Type: application/json

{}

• Confidence: 86% confidence
• Finding: The uninstall-app endpoint enables a destructive operation against the user's device with only a package name as input. In an agent-controlled environment, insufficient guardrails around such a parameter can lead to accidental or malicious removal of important apps, including security, communications, or business-critical applications.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description presents very broad capabilities like automating any Android app, social media, testing, data collection, or anything done manually, without meaningful trigger constraints or usage boundaries. In a device-control skill, this can cause over-invocation or use in sensitive contexts, increasing the chance of privacy-invasive, account-impacting, or unintended actions on a real phone.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill claims the API key is securely handled via an environment variable and that no data leaves the user's control, yet it also instructs the agent to ask the user to provide the API key directly if the variable is unavailable. Prompting for secrets in chat increases the risk of credential exposure in conversation logs, prompt history, or downstream tooling, undermining the stated security model.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation describes direct control over a real Android device, including tapping, typing, app management, screenshots, and UI inspection, but does not prominently warn users about privacy exposure or account-impacting actions. Because this can operate on a personal phone and real apps, the missing warning materially increases the risk of unintended purchases, message sending, account changes, or collection of sensitive on-screen data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Before You Start

Do NOT ask the user for an API key or to set up a device before checking. Always probe first:

1. **Resolve the API key:**
   - The key is provided via the `MOBILERUN_API_KEY` environment variable (set by OpenClaw during skill loading)

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The task API explicitly allows callers to submit credentials and files to an autonomous agent, but the documentation does not clearly warn that this data may be transmitted to Mobilerun infrastructure and then used during remote task execution. In a skill whose purpose is to automate a real Android device, that omission materially increases the risk of users exposing secrets or sensitive files without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Webhook setup sends task lifecycle data to a user-specified external target URL, but the documentation does not warn that task-related metadata will leave the Mobilerun environment and be delivered to another system. Because this skill deals with device automation and potentially sensitive task context, the omission can lead to unintentional disclosure to third-party endpoints.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Phone Control API Reference

Base URL: `https://api.mobilerun.ai/v1`
Auth: Use the `MOBILERUN_API_KEY` environment variable in the Authorization header.

This document covers how to control an Android device connected to Mobilerun.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Phone Control API Reference

Base URL: `https://api.mobilerun.ai/v1`
Auth: Use the `MOBILERUN_API_KEY` environment variable in the Authorization header.

This document covers how to control an Android device connected to Mobilerun.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Phone Control API Reference

Base URL: `https://api.mobilerun.ai/v1`
Auth: Use the `MOBILERUN_API_KEY` environment variable in the Authorization header.

This document covers how to control an Android device connected to Mobilerun.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Phone Control API Reference

Base URL: `https://api.mobilerun.ai/v1`
Auth: Use the `MOBILERUN_API_KEY` environment variable in the Authorization header.

This document covers how to control an Android device connected to Mobilerun.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documented screenshot and UI-state endpoints expose highly sensitive on-device data, including full screen contents, accessibility text, focused elements, and app context. In an agentic setting, this can reveal messages, passwords, MFA prompts, personal data, or other confidential content; the lack of an explicit privacy warning or consent boundary increases the risk of misuse or overcollection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The uninstall endpoint performs a destructive action on the user's device, yet the documentation does not clearly warn that it removes installed applications and may delete user access or related local app data. In an autonomous agent context, omission of that warning makes accidental destructive actions more likely.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: L018 states the API key should be stored securely and never hardcoded or exposed, but L081 later says the agent should provide that same key to the user during device connection. Even if the intended meaning is user-mediated entry into their own device, the wording contradicts the earlier secrecy guidance and could normalize key disclosure.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation materially understates the power of Android accessibility access by claiming it does not grant access to other apps' data, while the same section says it can read on-screen element names and positions across apps. This can mislead users into granting a highly privileged permission without informed consent, increasing privacy and abuse risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The setup directs use of an API key in the mobile app without an explicit warning that the key is a bearer credential that grants account/device access. Users may paste a long-lived secret into a device or app context without understanding the exposure, especially on a personal phone that may be compromised, shared, or logged.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Telling the agent to provide the user's API key back during setup creates a secret re-disclosure path, which can expose the credential in agent output, logs, transcripts, or prompt history. Even if the key originated from the user, repeating it violates least exposure and increases the chance of accidental leakage.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation makes a concrete billing/access claim that free users can control personal devices with no subscription, but immediately notes that free-plan details are still not finalized. This inconsistency can mislead users and downstream agents into taking actions based on unsupported entitlement assumptions, causing failed workflows, support churn, or accidental exposure of capabilities before policy and controls are finalized.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The document instructs users to place an API key in an Authorization header via an environment variable but provides no warning about secret handling, logging, or accidental disclosure. In agent/tooling ecosystems, such credentials are often exposed through debug logs, prompts, error messages, or misconfigured environments, which could allow unauthorized control of connected devices.

Static analysis

No suspicious patterns detected.