S2 Mothership [3.22 Native]

• Outcome: Review
• Latest audit: May 28, 2026 · 3:05 PM UTC
• Version: 1.1.3

Overview

This skill asks for and documents high-impact smart-home, local-network, and root-agent control that is much broader than its harmless local-spatial-tool description.

Install only if you intentionally want an experimental local smart-home/root-agent control framework. Do not provide Home Assistant, Tuya, or other device tokens until you have reviewed the configs, disabled real actuation by default, removed static tokens/auto-consent behavior, and isolated it from production locks, HVAC, alarms, or safety-related devices.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (214)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

real_mac = "UNKNOWN_MAC"
        try:
            # 跨平台提取局域网 ARP 缓存表
            arp_result = subprocess.check_output(["arp", "-a"], text=True)
            
            # 使用正则从 arp 表中精准提取网关设备的 MAC 地址
            # 适配格式: xx:xx:xx:xx:xx:xx 或 xx-xx-xx-xx-xx-xx

• Confidence: 89% confidence
• Finding: The subprocess call executes a host OS network utility to inspect ARP state, which is unnecessary for the declared spatial-logic/user-space purpose and creates an avoidable host-interaction surface. Even though it does not use shell=True and is not directly command-injectable, it enables environment fingerprinting and dependence on external binaries, which is risky in an agent skill.

Tainted flow: 'url' from os.getenv (line 68, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

# 真实物理控制逻辑
        print(f"      └─ 🔌 [物理执行层] 正在发送危险指令 POST {url} | 载荷: {payload}")
        try:
            response = requests.post(url, headers=HomeAssistantActuator.headers, json=payload, timeout=5)
            response.raise_for_status()
            print(f"      └─ ✅ [硬件响应] 成功执行真实物理指令！")
            return True

• Confidence: 92% confidence
• Finding: The code builds a network target from an environment-controlled base URL and then sends authenticated POST requests with a bearer token to that destination when real actuation is enabled. This creates a tainted outbound control path that can redirect privileged smart-home commands and credentials to an attacker-controlled endpoint via environment manipulation or misconfiguration.

Tainted flow: 'url' from os.getenv (line 129, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if SecurityEnforcer.validate_local_network(url):
                        try:
                            requests.post(url, headers=headers, json=req_payload, timeout=5)
                            print(f"      └─ ✅ [硬件响应] 成功调用本地物理设备！")
                        except Exception as e:
                            print(f"      └─ ❌ [连接失败] 物理网络异常: {e}")

• Confidence: 87% confidence
• Finding: The POST target is derived from environment-controlled configuration and used for authenticated network requests that can trigger physical device actions. Although the code attempts SSRF protection by resolving the hostname and requiring a private or loopback address, this is incomplete because it does not pin the resolved IP, restrict redirects, or fully prevent DNS rebinding / alternate address tricks between validation and request time.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The manifest declares broad capabilities including shell execution, file access, network access, credentials, and Python/SQLite dependencies despite presenting the skill as a simple local spatial logic framework. This mismatch increases the attack surface and could enable unauthorized data access, command execution, or remote interactions if the skill is installed under false assumptions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is narrow and low-risk, but the described behavior set is extremely broad and includes credential use, network calls, LAN scanning, device control, identity/access management, emergency workflows, and physical actuation such as doors and alarms. That kind of severe description-behavior mismatch is dangerous because it can mislead reviewers and users into granting a skill powerful capabilities that enable surveillance, lateral movement, privacy violations, or unsafe real-world actions.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The README materially contradicts the claimed isolation model by describing delegation of actions to a root-capable Openclaw bridge that can control physical hardware. This is dangerous because users may treat the skill as a low-risk user-space component when it is actually part of a privileged command path with real-world actuation potential.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The README advertises root privilege acquisition and physical hardware control despite the metadata describing a spatial logic and state-management framework. That mismatch can mislead operators into deploying a component with far greater authority than expected, increasing the chance of unsafe installation and abuse.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The documentation presents the system as safely isolated in spirit while also describing execution via root-level agents and hardware control. Misstated trust boundaries are a security problem because they cause users and integrators to apply weaker safeguards than the deployment actually requires.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The deployment guide documents capabilities far outside the declared scope of a 'spatial logic framework' safely isolated in user space, including LAN sniffing, smart-device discovery, industrial control connectivity, anti-theft logic, and local/remote LLM integration. This mismatch is dangerous because operators and automated agents may grant network, filesystem, and host-level privileges under false pretenses, enabling unexpected reconnaissance or control functions on the local environment.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The guide requires active LAN sniffing and access to IoT/building-control protocols such as SSDP, mDNS, Modbus TCP, KNX/IP, and Home Assistant, but these are not justified by the stated purpose of coordinate management. In this context, such capabilities materially increase attack surface and could be abused for network reconnaissance or interaction with physical systems that are unrelated to the advertised function.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The manifest claims the framework is 'safely isolated in user space,' but the deployment instructions require Docker host networking, OS-level ARP access, firewall interaction, and direct LAN probing. This contradiction can mislead users and orchestration agents into assuming stronger isolation than actually exists, resulting in overly broad deployment trust and unnecessary exposure of the host and local network.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The architecture guide documents capabilities far beyond the declared skill scope of local spatial logic and state compression, including scanning, actuation, identity, memory, and external integrations. This creates a material scope mismatch that can mislead reviewers and users about what the skill may do, weakening trust boundaries and increasing the chance of unsafe deployment.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The metadata claims safe isolation in user space, but the guide describes privileged and externally acting behavior such as hardware control, network discovery, webhook dispatch, and command interception. That contradiction is dangerous because operators may grant the skill trust or install it under assumptions that do not match its documented behavior.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The quick-start section explicitly says the simulator 'actively sniffs virtual networks,' which is not justified by the stated purpose of spatial logic/state compression. Network sniffing materially increases surveillance and attack-surface concerns, especially when presented as a default demo behavior without strong limitations.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The guide describes webhook configuration and cloud integrations that exceed the expected capability of a local user-space spatial framework. External dispatch paths can transmit structured environmental or behavioral data off-device, undermining the implied local-only safety posture.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The document makes privacy and consent claims, but elsewhere describes broad discovery and perception capabilities, creating an inconsistent and potentially misleading privacy model. When documentation overstates privacy guarantees, users may deploy surveillance-capable features without understanding actual collection risks.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest markets the skill as local and user-space isolated, yet it requests cloud/home-automation credentials and HTTP capabilities for Home Assistant and Tuya. This contradiction is dangerous because users may trust it as a harmless local utility while it is actually able to reach external services and control connected systems using supplied tokens.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Home automation and cloud actuation are not reasonably justified by a stated purpose limited to spatial state compression and coordinate management. Unjustified actuator access raises the risk of covert behavior or overprivileged deployment, especially where tokens can trigger actions in physical environments.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation uses reassuring language such as 'strictly sandboxed' and 'safely isolated in user space' while simultaneously acknowledging HTTP-based Home Assistant/Tuya actuation. Security-reassurance language that conflicts with actual capabilities is a red flag because it can suppress scrutiny and induce users to trust a skill that can still perform networked control actions outside a local sandbox boundary.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The configuration exposes functionality for a Chronos/Memzero memory vault, retention, archival, and timeline baseline management that materially exceeds the declared scope of a user-space spatial logic and coordinate tool. This kind of scope mismatch is dangerous because it can conceal undeclared data storage and environment-state processing capabilities from reviewers and operators, increasing the risk of unauthorized collection, retention, or misuse of sensitive contextual data.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The explicit warning that changing baseline parameters may affect life-safety compliance directly contradicts the claim that the skill is safely isolated in user space. This is dangerous because it indicates the configuration may influence safety-relevant physical or environmental behavior, meaning a misconfiguration or abuse could have real-world consequences while remaining disguised as a harmless user-space component.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is described as a safely isolated local spatial framework, but the configuration enables active HTTP webhook communication to an Openclaw task endpoint and also connects to a separate LLM service. Even though both endpoints are localhost, this breaks the stated isolation boundary and creates control-channel and prompt/data-flow surfaces that could be abused by other local processes or by a compromised peer service.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: A webhook-based control channel to Openclaw is not clearly necessary for a skill whose stated purpose is spatial logic and coordinate management. Unnecessary command-and-control style integration expands the attack surface, especially because the endpoint appears to accept tasking and uses a static bearer-like token in configuration.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill's stated purpose is a local spatial logic/state framework, but the code introduces unrelated enrollment, consent assertions, token injection, and simulated device/network control. This scope mismatch is dangerous because it normalizes privileged behaviors and can hide future harmful logic behind a benign manifest, undermining user trust and security review.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Collecting a user's email via CLI is unrelated to the advertised spatial framework functionality and occurs without clear purpose, privacy notice, storage policy, or consent flow. Even if optional, unnecessary personal data collection expands privacy risk and creates a channel for unauthorized data gathering.

Static analysis

No suspicious patterns detected.