ble-device-control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:55 AM UTC
• Version: 1.0.4

Overview

This BLE-control skill is coherent, but it asks users to rely on mutable remote code and enables device writes, background tasks, and persistent local configuration with limited safety guardrails.

Review before installing. Install airctl only from a pinned, trusted release or reviewed commit, preferably in a virtual environment without elevated privileges. Treat BLE writes, periodic tasks, daemon actions, aliases, and presets as operations that should require explicit user approval, especially around unfamiliar devices.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61

Finding

Unpinned Git Dependency Allows Mutable Remote Code Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-79
Vulnerability Type: Unpinned third-party Git dependency
Risk Level: Medium

Vulnerable Code

markdown

**Provenance:**

| Field | Value |
|-------|-------|
| Source Code | https://github.com/skinapi2025/AirCtl |
| License | MIT |
| Author | skinapi2025 |

**Verify airctl is installed:**

```bash
airctl --version

If airctl is not installed, ask the user to install it before proceeding. Provide the following installation command for the user to review and execute:

bash

pip install git+https://github.com/skinapi2025/AirCtl.git

> Note: Do NOT automatically run pip install without user confirmation. The user should verify the package source and approve the installation.

text

### Technical Analysis

The documented installation command retrieves and installs the current default branch of a remote Git repository without pinning a commit, signed tag, version, or artifact hash. Consequently, the code ultimately installed can change after this skill has been reviewed.

A Python package installation can execute package build hooks and install executable components. If the upstream repository, maintainer account, or dependency chain is compromised, the installation may execute attacker-controlled code. Checking `pip show airctl` after installation only verifies package metadata supplied by the package itself; it does not establish source integrity or prove that the installed revision was audited.

The requirement for user confirmation reduces the likelihood of silent exploitation, but it does not address the underlying integrity problem: the user is being asked to approve a mutable source whose exact contents are not identified.

### Attack Path

1. An attacker compromises the referenced GitHub repository, its maintainer account, or the repository's default branch.
2. The attacker adds malicious installation hook
...[truncated 1332 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specific, reviewed commit rather than its mutable default branch:

   bash

   pip install "git+https://github.com/skinapi2025/AirCtl.git@<audited-full-commit-sha>"
   

2. Prefer a trusted package release with an exact version and verified hash. Publish a locked requirements file containing --hash entries and install with:

   bash

   pip install --require-hashes -r requirements.txt
   

3. Record the expected commit SHA, release signature, package version, and artifact hashes in the skill so users can independently verify integrity.

4. Use signed releases or signed Git tags and document signature verification before installation.

5. Install in an isolated virtual environment with minimum privileges. Explicitly warn users not to run the installation with sudo or from a privileged agent account.

6. Replace the pip show metadata check with integrity verification against independently documented hashes or signatures. Metadata alone must not be treated as proof of provenance.

7. Review and lock the dependency's transitive dependencies, because pinning only the top-level Git commit does not prevent mutable downstream packages from being resolved during installation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 88% confidence

Finding

The skill directs the user to install and execute a package directly from a GitHub repository via pip, which is a remote bootstrap/install pattern with significant supply-chain risk. Even with a note not to auto-run it, the skill operationalizes trust in unpinned remote code that could later change or be compromised.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

irctl` CLI tool.

Provenance:

Field	Value
Source Code	https://github.com/skinapi2025/AirCtl
License	MIT
Author	skinapi2025

Verify airctl is installed:

bash

airctl --version

If airctl is not installed, ask the user to install it before proceeding. Provide the following installation command for the user to review and execute:

bash

pip install git+https://github.com/skinapi2025/AirCtl.git

Note: Do NOT automatically run pip install without user confirmation. The user should verify the package source and approve the installation.

After installation, verify the package origin:

bash

pip show airctl

Confirm that the output shows Home-page: https://github.com/skinapi2025/AirCtl or Author: skinapi2025.

Decision Tree

Follow this decision tree to determine which workflow to execute. Start from the top and follow the FIRST matching path:

text

User mentions Bluetooth/BLE device operation?
│
├

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill MUST invoke on a very broad set of Bluetooth- or BLE-related terms, which increases the chance of unintended activation. Over-broad triggering can route unrelated requests into a skill that performs scans, connections, reads, writes, or installs tooling, creating unnecessary exposure to risky actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

pip install git+https://github.com/skinapi2025/AirCtl.git

text

> **Note:** Do NOT automatically run `pip install` without user confirmation. The user should verify the package source and approve the installation.

After installation, verify the package origin:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill provides write-characteristic workflows and examples, but it does not prominently warn that BLE writes can trigger physical device behavior, configuration changes, alarms, pairing changes, or service disruption. In a BLE-control context this omission is more dangerous because writes may affect real-world devices, not just data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is presented as BLE device control, but its documented command set also includes persistent alias and preset configuration operations. That broadens the effective capability surface beyond transient device interaction into lasting local state changes, which can surprise users or downstream agents and be abused to alter future behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.