Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Android Control
v0.1.1Control an Android device via command-line tools (uiautomator, screencap, input, am). Automatically attempts non-root execution first and falls back to root...
⭐ 1· 584·0 current·0 all-time
by@kv0768
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the instructions: the SKILL.md drives uiautomator, screencap, input, and am and explicitly supports a su fallback. The metadata lists the expected Android binaries (uiautomator, input, am, screencap) as optional, which is proportionate to the described capability.
Instruction Scope
The SKILL.md assumes it runs in an environment that already has Android CLI tools available but does not specify HOW to reach the Android device (adb shell, direct device execution, ssh, etc.). It runs commands that read device files (/sdcard/ui_dump.xml) and produce screenshots, and it will retry under su (root). It also uses utilities not listed in metadata (cat, base64) — these may not exist on all Android shells or could be resolved to host utilities if run on the wrong machine. The lack of explicit connection/context instructions raises a real risk that these commands could be executed on an unintended host or without required safeguards.
Install Mechanism
Instruction-only skill with no install spec or downloaded artifacts. This minimizes install-time risk since nothing is written to disk by an installer.
Credentials
The skill requests no environment variables or credentials, which is proportionate. However, it does instruct escalation to root (su) on the target device — necessary for some device operations but also a sensitive capability.
Persistence & Privilege
always is false and the skill is not force-included. The skill permits running root-mode commands on whatever shell the agent uses; autonomous invocation combined with connectivity to an Android device could allow the agent to perform sensitive actions (screenshots, UI dumps, installing or launching apps) without additional confirmation. This is expected for a remote-control skill but is worth guarding with confirmations and explicit targeting.
What to consider before installing
This skill is coherent for controlling an Android device, but review these items before enabling it: 1) Clarify execution context: ensure the agent will execute these commands on an intended Android device (for example via 'adb shell' or a controlled device session), not on your local host. 2) Root fallback: the skill will call su and run commands as root if non-root fails — confirm you want the agent to have that ability and require explicit user consent before root actions. 3) Missing utilities: SKILL.md uses cat and base64 but they are not declared; verify those tools exist on the target device or adjust instructions. 4) Sensitive outputs: UI dumps and screenshots can expose personal data — restrict usage to trusted devices and require explicit permission. 5) Test in a safe environment first (a disposable device or emulator) and consider adding explicit prompts/confirmation in the SKILL.md before any destructive or root-level commands are executed.Like a lobster shell, security has layers — review code before you run it.
latestvk976dqx3ft4bxgxg095xrm51xn8270fy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📱 Clawdis
Binssh