ClawHub
Back to skill

Security audit

Midscene Automations Skills for HarmonyOS

Security checks across malware telemetry and agentic risk

Overview

This skill is openly for HarmonyOS device automation, but it gives an agent broad connected-device control, including raw shell commands, without clear safety boundaries.

Install only for trusted test devices and test accounts. Treat it as high-privilege device automation: review the Midscene npm package and model provider, avoid screens containing secrets or personal data, and require explicit approval before any raw HDC shell command, deletion, account change, message sending, purchase, or other irreversible action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill explicitly exposes a generic `runhdcshell --command` pathway that forwards arbitrary strings to `hdc shell` on the connected device. Even though the skill is framed as UI automation, this materially expands capability into unrestricted low-level device command execution, enabling file access, settings changes, data extraction, package manipulation, or other harmful operations if the agent is prompted or misled.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The skill documents use of API keys and powerful device-control operations but does not warn users that screenshots, prompts, and on-device content may be sent to external model providers and that device commands can affect system state. In a vision-driven automation skill, this omission increases the risk of accidental exposure of sensitive screen contents, credentials, or private device data to third parties.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The reference-image workflow encourages passing remote image URLs and optionally fetching and converting them to base64, but it does not disclose that this causes external network access. That can leak usage metadata, trigger requests to untrusted hosts, or cause the agent to retrieve attacker-controlled content during automation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.