ClawHub
Back to skill

Security audit

Rivian Ls

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate Rivian telemetry purpose, but it asks users to install and authenticate a third-party CLI that handles sensitive vehicle location and account credentials with weak scoping and safety guidance.

Install only if you trust the rivian-ls upstream project and are comfortable giving it ongoing access to sensitive vehicle telemetry, including location. Prefer a pinned, verified release; avoid putting passwords or OTPs directly in shell commands or long-lived environment variables; protect or remove the credential cache when not needed; and do not expose dashboard or cron outputs unless access is restricted.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:28
Finding

Rivian Password and MFA Code Exposed Through Process Arguments and Environment Variables

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

rivian-ls login --otp 123456

text

Credentials are cached automatically at `~/.config/rivian-ls/credentials.json` and auto-refresh. Subsequent runs use the cache — no re-auth needed unless tokens expire.

## Usage

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

Documenting that credentials are cached at a fixed path highlights a sensitive secret store that could be targeted by other tools, users, or malicious prompts in an agentic environment. Because the cache enables ongoing authenticated access to vehicle status and location-related telemetry, compromise of this file could lead to persistent privacy loss and unauthorized account access.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

rivian-ls login --otp 123456

text

Credentials cache to `~/.config/rivian-ls/credentials.json` and auto-refresh. After initial auth, subsequent runs use the cache automatically.

**Non-interactive (single command, if OTP is known in advance):**
```bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly advertises access to GPS location and dashboard exposure of Rivian telemetry, but it does not provide any meaningful privacy warning, consent guidance, retention limits, or recommendations to avoid exposing precise location data to other users or services. Because vehicle location is highly sensitive and can reveal home/work patterns and real-time whereabouts, normalizing its collection and sharing in automations increases privacy and stalking risk if the skill is used carelessly or the downstream dashboard/API is exposed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes shell commands extensively but does not declare any tool scope or allowed-tools boundary. In an agent environment, that omission can let the model execute shell actions more broadly than intended, increasing the chance of unsafe command execution, credential exposure, or privacy-impacting telemetry access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The authentication section shows plaintext email/password/OTP usage on the command line and mentions persistent local credential caching, but it does not warn that command-line arguments may be exposed via shell history or process listings. In this skill's context, the data grants access to sensitive vehicle telemetry and potentially location information, so unsafe credential-handling guidance meaningfully raises privacy and account-compromise risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rivian_status.py (reported line 31)May include surrounding context.

python
if not live:
        cmd.append("--offline")
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Static analysis

No suspicious patterns detected.