Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-built for Android phone control, but it asks users to install mutable external software and can forward sensitive SMS and notification contents with limited warning.

Review before installing. Prefer a spare Android device with minimal personal data, pin and verify the npm package and APK if possible, grant only permissions you need, and enable callbacks only to HTTPS endpoints you control because SMS and notification contents may be forwarded.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned Global npm Package Installation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:28
Finding: Android Application Installation Without Documented Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The webhook forwarding feature explicitly sends notification and SMS content in HTTP POST payloads to a configured external endpoint, but the documentation does not clearly warn that highly sensitive message content, phone numbers, device identifiers, and metadata may leave the local device/server boundary. Because the feature is framed as convenient event delivery and even includes delivery-channel fields, users may unintentionally exfiltrate private communications to third-party services or insecure endpoints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises high-risk capabilities including calling, SMS, file access, UI automation, clipboard access, location, notifications, and shell execution, but the top-level description does not prominently warn users about the safety and privacy consequences of granting such broad control over a personal mobile device. This can lead users to enable the skill without understanding that it can access sensitive communications, manipulate apps, and perform actions on their behalf.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.