Midscene Automations Skills for Android

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:50 PM UTC
• Version: 1.0.3

Overview

This skill is a coherent Android automation tool, but it gives an agent broad device-control powers with under-scoped raw ADB access, broad triggers, mutable package execution, and sensitive screenshot/report handling.

Review before installing. Use this only with a dedicated test device or emulator, avoid sensitive accounts or private screens, confirm before raw ADB shell actions, and prefer a pinned audited Midscene package version or a locked project install instead of repeated npx -y execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Mutable Third-Party Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

Automate Android devices using `npx -y @midscene/android@1`. Each CLI command maps directly to an MCP tool — you (the AI agent) act as the brain, deciding which actions to take based on screenshots.

The command pattern is subsequently used throughout the file, including:

bash

npx -y @midscene/android@1 connect

Technical Analysis

The Skill directs the agent to use npx -y to retrieve and immediately execute @midscene/android. The -y option suppresses the interactive installation confirmation, while the version selector @1 restricts only the major version rather than pinning one immutable, audited release.

Consequently, the effective code executed by the Skill can change without any corresponding change to the reviewed SKILL.md file. A newly published compatible release, or one of its transitive dependencies, may be selected during a later invocation. npm packages can also execute installation lifecycle scripts, so package code may run before the requested Android CLI operation begins.

This is a supply-chain exposure rather than evidence that the named package is currently malicious. No lockfile, integrity hash, vendored dependency, or other mechanism for reproducing the reviewed dependency set is included in the project.

Attack Path

1. An attacker compromises the package publisher account, package distribution process, or a transitive dependency used by a release matching @midscene/android@1.
2. The attacker publishes a malicious version that still satisfies the mutable major-version selector.
3. An agent follows the Skill and invokes a documented npx -y @midscene/android@1 ... command.
4. npx retrieves the selected package and dependencies without requesting installation confirmation.
5. Malicious pa ...[truncated 1138 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable major-version selector with an exact, reviewed package version, for example @midscene/android@1.x.y.
2. Manage the dependency through a project manifest and commit a lockfile containing resolved versions and registry integrity hashes.
3. Install dependencies in a controlled setup phase rather than automatically downloading them during each Skill invocation.
4. Configure npm to use the expected official registry and reject unapproved registries or package sources.
5. Verify package provenance, signatures, checksums, and publisher identity before approving upgrades.
6. Review transitive dependency changes whenever the pinned package version is updated.
7. Disable npm lifecycle scripts where operationally feasible, or explicitly audit every required lifecycle script before enabling it.
8. Execute the automation CLI inside a sandbox or container with minimal filesystem and network access.
9. Provide model credentials through short-lived, least-privilege secrets and prevent unnecessary environment variables from reaching the package process.
10. Restrict ADB access to a dedicated test device or emulator containing no sensitive data, and disconnect the device after the task.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords are broad enough to match ordinary mobile-related requests like opening apps, testing a phone app, or checking whether something works on Android. That increases the chance this powerful automation skill is invoked in contexts where the user did not clearly intend device control, exposing a connected device to unintended taps, launches, text entry, or shell-assisted actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents a raw ADB shell passthrough capability but does not prominently warn that it can execute low-level commands directly on the connected device. In practice this enables actions beyond visible UI automation, including changing system state, reading device information, interacting with app data surfaces, or disrupting the device if invoked carelessly or through ambiguous user prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to take screenshots and consume detailed HTML reports with replay artifacts, but it does not warn that these files may capture sensitive on-device content such as messages, emails, tokens, account names, or other personal data visible on screen. Because the workflow explicitly encourages storing and summarizing these artifacts, the privacy exposure is materially increased.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.