Tesla Smart Charge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:38 PM UTC
• Version: 1.1.1

Overview

The skill has a coherent Tesla charging purpose, but it needs review because it automates live Tesla account actions and contains a real shell-command injection issue despite claiming that risk is absent.

Review this before installing. Only use it if you are comfortable with unattended Tesla account commands changing charge limits or starting charging. Pin and verify the tesla dependency, fix the shell=True auto-start command, pass only required environment variables, and avoid enabling cron or --auto-start until those issues are addressed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tesla-smart-charge.py:184

Finding

Shell Command Injection in the Automatic Charging Path

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.txt:14

Finding

Unpinned Executable Tesla Skill Dependency

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/tesla-smart-charge.py:102

Finding

Insufficient Validation of Schedule and Numeric Inputs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (12)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tesla-smart-charge.py (reported line 46)May include surrounding context.

python

return None
            
            # Use Tesla skill to get status - use list args to avoid shell injection
            env = os.environ.copy()
            env['TESLA_EMAIL'] = self.tesla_email
            output = subprocess.check_output(
                ['python3', str(self.tesla_skill_dir / 'scripts' / 'tesla.py'), 'status'],

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tesla-smart-charge.py (reported line 78)May include surrounding context.

python

return None
            
            # Use Tesla skill to get status - use list args to avoid shell injection
            env = os.environ.copy()
            env['TESLA_EMAIL'] = self.tesla_email
            output = subprocess.check_output(
                ['python3', str(self.tesla_skill_dir / 'scripts' / 'tesla.py'), 'status'],

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a concrete tool-parameter abuse vector because the script passes attacker-influenced data into a shell command that invokes a privileged external tool capable of controlling charging. In this skill context, successful exploitation could lead both to arbitrary command execution on the host and unauthorized execution of a vehicle action.

Content

Scanner excerpt · scripts/tesla-smart-charge.py (reported line 187)May include surrounding context.

python

def start_charging(self):
        """Trigger charging on the vehicle"""
        try:
            subprocess.run(
                f'TESLA_EMAIL="{self.tesla_email}" python3 {self.tesla_skill_dir}/scripts/tesla.py charge start',
                shell=True,
                check=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to set up unattended cron jobs that will automatically modify Tesla charging behavior and charge limits, but it does not clearly warn that these actions change live vehicle settings on a recurring basis. In a vehicle-control context, missing disclosure increases the chance of unintended operational changes, battery wear, unexpected charging costs, or charging at the wrong times if the schedule or environment is misconfigured.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill clearly automates live changes to a Tesla vehicle's charging behavior, including scheduled charge initiation logic and charge-limit changes, but the documentation does not prominently warn users that these actions affect a real vehicle account on an ongoing cron basis. This can lead to unintended or poorly understood vehicle state changes, especially if users copy-paste the cron setup without appreciating that the automation will continue making account-backed changes after initial setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document instructs users to set up unattended scheduled execution that can trigger real-world Tesla charging actions, but it does not include a clear warning or consent boundary about autonomous device control. In the context of a vehicle-control skill, normalizing silent daily execution increases the chance of unintended charging behavior, cost impacts, or unsafe automation if configuration is wrong or the environment is shared.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The cron setup creates persistent background automation that continues running after initial user interaction, which is a form of session persistence. In a skill that can affect a physical device, persistence is more sensitive because the action may recur without fresh user intent, and the task string embeds account-identifying context that may be reused indefinitely.

Content

Scanner excerpt · references/cron_setup.md (reported line 7)May include surrounding context.

Quick Setup

Create a cron job that runs at midnight and checks if a charge is scheduled:

bash

clawdbot cron add \

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The top-level description frames the tool as a scheduler/optimizer, but the implementation can directly start charging. This mismatch can mislead a reviewer or operator into granting the skill more trust or autonomy than intended, increasing the chance of unsafe execution of real-world actions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tesla-smart-charge.py (reported line 48)May include surrounding context.

python

# Use Tesla skill to get status - use list args to avoid shell injection
            env = os.environ.copy()
            env['TESLA_EMAIL'] = self.tesla_email
            output = subprocess.check_output(
                ['python3', str(self.tesla_skill_dir / 'scripts' / 'tesla.py'), 'status'],
                stderr=subprocess.DEVNULL,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tesla-smart-charge.py (reported line 80)May include surrounding context.

python

# Use Tesla skill - use list args to avoid shell injection
            env = os.environ.copy()
            env['TESLA_EMAIL'] = self.tesla_email
            result = subprocess.run(
                ['python3', str(self.tesla_skill_dir / 'scripts' / 'tesla.py'), 
                 'charge-limit', str(limit_percent)],
                capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This call constructs a shell command with an f-string and executes it with shell=True while interpolating self.tesla_email and a filesystem path directly into the command line. An attacker who can influence TESLA_EMAIL or the path could break out of quoting and execute arbitrary commands, making this a real command injection issue in a script that can also control a vehicle-related action.

Content

Scanner excerpt · scripts/tesla-smart-charge.py (reported line 187)May include surrounding context.

python

def start_charging(self):
        """Trigger charging on the vehicle"""
        try:
            subprocess.run(
                f'TESLA_EMAIL="{self.tesla_email}" python3 {self.tesla_skill_dir}/scripts/tesla.py charge start',
                shell=True,
                check=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script can trigger charging automatically when --auto-start is supplied and timing conditions are met, without an additional runtime confirmation or prominent warning. In a vehicle-control context, that creates a real safety and operational risk because an automated run may perform a physical-world action the user did not intend at that moment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.