Security audit

Byted Ai Mobileuse Agent

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real cloud-phone automation skill, but it needs review because it can control live mobile sessions, use sensitive cloud credentials, and optionally record screens without strong safety guidance.

Install only if you intentionally want an agent to operate Volcengine Cloud Phone resources. Use least-privilege, scoped credentials through environment variables, a trusted proxy, or a secrets manager; avoid command-line secrets; require human confirmation before tasks involving purchases, messages, logins, account changes, or sensitive forms; enable screen recording only when the storage bucket, access controls, and retention are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill instructs the host agent to use this capability by default for broadly defined mobile/phone automation requests, which can cause autonomous execution against real mobile sessions without an explicit suitability or consent check. In context, this is more dangerous because the skill can launch apps, navigate UI, fill forms, and potentially interact with sensitive accounts or data on a cloud phone.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill supports screen recording and storage to object storage but does not prominently warn users about privacy, data retention, or the possibility of capturing credentials, personal content, or other sensitive screen data. This omission is significant in a mobile automation context because recorded sessions may include app contents, tokens, messages, and PII, increasing confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly instructs users to create and record an AccessKey ID and SecretAccessKey for later use, but provides no controls for secure generation, storage, rotation, scoping, or prohibition on sharing the secret. In an agent-skill context, this is dangerous because operators may paste long-lived cloud credentials into prompts, notes, skill files, or object storage, creating a straightforward path to credential leakage and full account or business-resource compromise.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation instructs users to pass access credentials via command-line arguments, which can expose secrets through shell history, process listings, job control tools, logging systems, and CI/CD output. In the context of a cloud-phone automation agent that can trigger privileged API actions, leaked AK/SK credentials could enable unauthorized access to the associated cloud resources.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/sdk_client.py:60