ClawHub
Back to skill

Security audit

Android GUI Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Android automation tool, but it gives an AI agent very broad control over a real phone without enough scoping or confirmation for sensitive actions.

Install only if you are comfortable giving an agent broad control of an Android device. Use a test phone or test accounts, keep USB/wireless debugging off when not actively needed, avoid banking/payment/private-message screens, do not let the agent post or clear/install apps without explicit review, and treat Telegram bot tokens, screenshots, UI dumps, and logs as sensitive data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/u2_mcp_server.py:75
Finding

Caller-Controlled Screenshot Path Permits Overwriting Writable Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/u2_mcp_server.py:89
Finding

Sensitive Screenshot Remains in a Fixed Shared-Storage Temporary File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (27)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/android_automation.py (reported line 18)May include surrounding context.

python
#!/usr/bin/env python3
"""
android_automation.py
多平台 Android GUI 自动化 — 淘宝/拼多多/小红书/抖音/京东 比价+发帖
支持 Hermes Agent crontab 定时执行
"""

import uiautomator2 as u2
import time
import json
import os
import re
import schedule
import requests
from datetime import datetime

# ============ 配置区 ============
DEVICE_IP = os.environ.get("ANDROID_DEVICE", "auto")
TG_BOT_TOKEN = os.environ.get("TG_BOT_TOKEN", "")
TG_CHAT_ID = os.environ.get("TG_CHAT_ID", "")
DEFAULT_APPS = ["taobao", "pinduoduo", "jd"]
# =================================

APP_PACKAGES = {
    "taobao":     "com.taobao.taobao",
    "jd":         "com.jingdong.app.mall",
    "pinduoduo":  "com.xunmeng.pinduoduo",
    "xiaohongshu":"com.xingin.xhs",
    "douyin":     "com.ss.android.ugc.aweme",
    "wechat":     "com.tencent.mm",
    "meituan":    "com.sankuai.meituan",
    "weibo":      "com.sina.weibo",
    "bilibili":   "tv.danmaku.bili",
}

d =

Tainted flow: 'url' from os.environ.get (line 247, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/android_automation.py (reported line 249)May include surrounding context.

python
if TG_BOT_TOKEN and TG_CHAT_ID:
        url = f"https://api.telegram.org/bot{TG_BOT_TOKEN}/sendMessage"
        try:
            requests.post(url, data={
                "chat_id": TG_CHAT_ID,
                "text": message,
                "parse_mode": "Markdown"

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/taobao_price_monitor.py (reported line 105)May include surrounding context.

python
等待元素出现
d(text="搜索").wait(timeout=10.0)
d.implicitly_wait(10)

# 读取屏幕文字
d.dump_xml()  # 获取 UI 层次结构
```

### 淘宝比价实战脚本

```python
#!/usr/bin/env python3
"""
taobao_price_monitor.py
淘宝商品价格监控 — 定时搜索、比价、通知
"""

import uiautomator2 as u2
import time
import json
import os
from datetime import datetime

DEVICE = os.environ.get("ANDROID_DEVICE", "auto")  # 自动发现或指定 IP
PRODUCT_KEYWORD = os.environ.get("PRODUCT", "iPhone 16 256GB")
TARGET_PRICE = float(os.environ.get("TARGET_PRICE", "6000"))  # 目标价格
CHECK_INTERVAL = 3600 * 6  # 每6小时检查一次
PRICE_HISTORY_FILE = "price_history.json"

d = u2.connect(DEVICE if DEVICE != "auto" else None)

def load_history():
    if os.path.exists(PRICE_HISTORY_FILE):
        with open(PRICE_HISTORY_FILE) as f:
            return json.load(f)
    return {}

def save_history(history):
    with open(PRICE_HISTORY_FILE, "w") as f:
        json.dum

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill advertises extremely broad trigger conditions such as any phone automation, app control, screen scraping, posting, and human-like operation across many popular apps. This can cause the agent to invoke the skill for routine user requests without clear consent boundaries, enabling sensitive actions on a real device including account actions, data access, and external communications.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill exposes destructive and privacy-sensitive capabilities including app_clear, app_install, clipboard access, file transfer, log access, shell execution, and device unlock, but provides no safety gating, warnings, or approval requirements. In this context, an autonomous agent controlling a real Android device can erase app data, exfiltrate sensitive information, install software, or execute arbitrary commands with significant user harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Xiaohongshu automation directly reaches a final 发布 action without any confirmation, review step, or user warning. In a mobile automation context this can cause accidental publication from a logged-in account, leading to unauthorized posts, leakage of private media, or account enforcement actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Douyin posting path automates a publish workflow and ends with a 发布 action without explicit user confirmation or a visible warning. Because the automation drives a real authenticated mobile app, a mistaken or malicious invocation can publish content publicly from the user's account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The main instructional description is written in Chinese even though the skill metadata and surrounding documentation are otherwise accessible to broader users. There is no indication that Chinese is required for a justified regional purpose or that users may choose another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide instructs users to enable USB debugging and optional wireless debugging, which materially increases device attack surface if left enabled or exposed to untrusted hosts or networks. In a mobile automation context this is expected setup, but omitting any warning or hardening guidance can lead users to leave powerful debugging interfaces enabled beyond the task's scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The screenshot and UI XML examples can capture sensitive on-screen information, account data, message contents, and app structure without any privacy warning. In an automation skill targeting consumer apps, this is especially relevant because dumps and screenshots may unintentionally collect credentials, personal data, or proprietary content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The OCR section explicitly mentions online OCR services, which may transmit screen text to third parties and expose personal, financial, or authentication-related content. Because the source data comes from device screens, users may unknowingly upload highly sensitive material without informed consent or data-handling controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The Telegram notification example sends data to a third-party service and uses a bot token, but the guide gives no warning about disclosure risks, token secrecy, or message content sensitivity. In practice, operators may include product data, account details, or other sensitive automation output in notifications, creating avoidable leakage and credential exposure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This curl example performs an external transmission to the Telegram Bot API. The transmission itself is expected functionality, but it becomes a security issue when documentation does not constrain what may be sent or how the bot token should be protected, increasing the chance of sensitive data disclosure or credential misuse.

Content

Scanner excerpt · references/setup-guide.md (reported line 93)May include surrounding context.

bash
# 测试通知
curl -X POST "https://api.telegram.org/bot<TOKEN>/sendMessage" \
  -d "chat_id=<CHAT_ID>" \
  -d "text=测试消息" \
  -d "parse_mode=Markdown"

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This curl example performs an external transmission to the Telegram Bot API. The transmission itself is expected functionality, but it becomes a security issue when documentation does not constrain what may be sent or how the bot token should be protected, increasing the chance of sensitive data disclosure or credential misuse.

Content

Scanner excerpt · references/setup-guide.md (reported line 93)May include surrounding context.

bash
# 测试通知
curl -X POST "https://api.telegram.org/bot<TOKEN>/sendMessage" \
  -d "chat_id=<CHAT_ID>" \
  -d "text=测试消息" \
  -d "parse_mode=Markdown"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill reads Telegram bot credentials from environment variables and can send monitoring results off-device, which is an extra remote-communication capability beyond local GUI automation. In an agent-skill context, undisclosed egress increases risk because collected data can be transmitted externally without an obvious prompt at runtime.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file is framed as Android price comparison/monitoring automation, but it also contains social-media publishing functions for Xiaohongshu and Douyin. That hidden expansion of capability is dangerous because a user expecting passive comparison may instead run automation that posts content to external platforms, creating account, reputational, and policy-compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The notify path transmits collected monitoring results to Telegram automatically and there is no user-facing disclosure in the execution path that data will leave the device. In an automation skill, silent outbound messaging is risky because users may not expect external transmission of search terms, price history, or generated reports.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The script contains a hardcoded external transmission path to the Telegram API. External egress is not inherently malicious, but in this skill context it materially increases risk because it allows local monitoring outputs to be sent to a third-party service.

Content

Scanner excerpt · scripts/android_automation.py (reported line 247)May include surrounding context.

python
# ============ 通知 ============
def notify(message):
    if TG_BOT_TOKEN and TG_CHAT_ID:
        url = f"https://api.telegram.org/bot{TG_BOT_TOKEN}/sendMessage"
        try:
            requests.post(url, data={
                "chat_id": TG_CHAT_ID,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs an external HTTP request to Telegram containing product-monitoring results, but the embedded script offers no confirmation prompt or user-facing disclosure at the point of transmission. Although the top-level file mentions Telegram/WeChat alerts generally, the script itself does not clearly warn that collected monitoring data will be sent to a third-party service when credentials are configured.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/taobao_price_monitor.py (reported line 207)May include surrounding context.

python
bot_token = os.environ.get("TG_BOT_TOKEN")
        chat_id = os.environ.get("TG_CHAT_ID")
        if bot_token and chat_id:
            url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
            requests.post(url, data={"chat_id": chat_id, "text": message, "parse_mode": "Markdown"})
    except Exception as e:
        print(f"通知发送失败: {e}")

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file documentation and module docstring describe this as a periodic monitor with '定时搜索' and a 6-hour check interval, yet the code only calls check_price() once and then loops over schedule.run_pending() without ever registering a scheduled task. This is an active contradiction between the documented intent and the implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The screenshot tool captures the full device screen and returns image data or stores it at an arbitrary path without any access control, masking, or confirmation step. In this skill context, the server is explicitly designed for remote UI automation over MCP, so screenshots can expose OTPs, chats, account pages, payment data, and other sensitive on-screen information to any client allowed to call the tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The screen hierarchy export returns the full UI XML, which often contains visible text, labels, content descriptions, and app structure that may reveal personal or security-sensitive information. In an Android automation server, this is especially dangerous because it provides a machine-readable inventory of the current screen, making downstream scraping of secrets and targeted interaction significantly easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The input_text tool echoes the submitted text back in the response, which can leak secrets such as passwords, OTPs, API tokens, or personal messages into MCP logs, client transcripts, or other observability systems. Because this server is intended for automation of arbitrary mobile apps, operators may use it on login or payment screens where echoed input is highly sensitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The search_product tool types a user-provided keyword into a shopping app and triggers a search, which transmits that data to a third-party application/service. The file does not include any warning that search terms may be sent off-device or exposed to external platforms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.