mobizen-gui

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:59 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent Android automation purpose, but its setup instructions expose users to high-impact risks around credentials, unpinned remote code, network services, and phone input control.

Install only if you are comfortable reviewing and constraining the setup yourself. Prefer USB ADB, avoid enabling network ADB, bind local model servers to 127.0.0.1, do not paste production API keys into chat, keep secrets out of project files, verify APK/model/dependency sources, and run the model stack in a restricted environment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:117

Finding

Unreviewed Remote Model Code Is Allowed to Execute on the Host

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:30

Finding

Third-Party APK and Python Dependencies Are Installed Without Integrity Verification

Content

View full analysis

:5555 adb install ADBKeyboard.apk # download from https://github.com/senzhk/ADBKeyBoard ``` ```bash git clone https://github.com/alibaba/MobiZen-GUI.git && cd MobiZen-GUI pip install -r requirements.txt # openai, pillow, pyyaml ``` ```bash pip install -U huggingface_hub # China mirror (optional) export HF_ENDPOINT=https://hf-mirror.com hf download alibabagroup/MobiZen-GUI-4B --local-dir ./MobiZen-GUI-4B ``` ```bash pip install vllm==0.11.0 ``` ### Technical Analysis The Skill directs users to install an APK whose exact release, signing certificate, and checksum are unspecified. It also installs Python dependencies from a requirements file in a mutable cloned repository and upgrades `huggingface_hub` to the latest available version with `-U`. Although `vllm` is version-pinned, the instructions do not require hashes, signatures, a lockfile, or a trusted package index. Version pinning alone does not protect against a compromised package repository or republished artifact. The APK is especially sensitive because it is enabled as an Android input method. A malicious or substituted keyboard package could receive substantial visibility into text entered on the device. ### Attack Path 1. An attacker compromises an upstream repository, package publisher, package index, release artifact, mirror, or user download path. 2. The attacker supplies a malicious APK or Python package under the expected name or version. 3. The user follows the Skill and installs the artifact without validating a checksum or signer. 4. Python installation hooks execute on the host, or the malicious keyboard is installed and enabled on the Android device. 5. The malicious component accesses ...[truncated 516 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:128

Finding

ADB and Model API Services Are Exposed to Reachable Networks Without Required Access Controls

Content

View full analysis

:5555 ``` ```bash pip install vllm==0.11.0 vllm serve ./MobiZen-GUI-4B --host 0.0.0.0 --port 8000 --trust-remote-code ``` ### Technical Analysis The ADB command enables the Android Debug Bridge over TCP port 5555. The vLLM command binds its API to `0.0.0.0`, making it listen on every host interface. The Skill does not require firewall restrictions, authentication, TLS, network segmentation, or shutdown of TCP ADB after use. Actual exploitability depends on ADB pairing/authentication behavior, vLLM configuration, host firewall policy, and network reachability. Nevertheless, the prescribed configuration unnecessarily broadens the attack surface and may expose device-control or inference interfaces to other local-network users, container peers, cloud-network tenants, or the public internet. ### Attack Path 1. A user enables TCP ADB or starts vLLM with the documented commands. 2. Port 5555 or 8000 becomes reachable through a local, container, cloud, or public network interface. 3. An attacker scans the reachable host and identifies the exposed service. 4. The attacker attempts to connect to ADB or sends requests to the model endpoint. 5. If pairing, firewall, or API access controls are absent or insufficient, the attacker gains device-control capability or unauthorized model API access. 6. The attacker performs device actions, consumes computational resources, or submits and observes sensitive inference workloads as permitted by the exposed interface. ### Impact Assessment Exposure of an insufficiently protected ADB service could permit extensive Android device control, including application interaction, command execution within ADB's authorization scope, data access, application installatio ...[truncated 264 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:52

Finding

API Keys Are Requested Through Conversation and Stored in Plaintext Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description says to use the skill when the user wants to 'control a phone' or 'run agent' and lists broad keyword triggers such as 'phone task' and 'run agent'. These phrases overlap with generic requests and the file does not provide constraints or negative examples to clarify when the skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

macOS

brew install android-platform-tools

Linux

sudo apt-get install android-tools-adb

Windows: download from https://developer.android.com/studio/releases/platform-tools

adb version # verify

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

yaml

api_key: "your-api-key-here"
base_url: "https://api.openai.com/v1"   # your model endpoint
model_name: "gpt-4o"                    # model identifier

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

yaml

api_key: "your-api-key-here"
base_url: "https://api.openai.com/v1"   # your model endpoint
model_name: "gpt-4o"                    # model identifier

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly tells the AI to ask the user for an API key and write it into a local config file, but provides no warning about secret handling, storage risk, or safer alternatives. This increases the chance that sensitive credentials are collected in chat logs, persisted insecurely on disk, or echoed back to the user/session history.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup flow directs the AI to collect the user's API credentials interactively, which is a classic secret-handling anti-pattern. Even if the intent is convenience, routing secrets through the AI creates unnecessary exposure through prompts, logs, transcripts, and downstream tooling integrations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

model_name: "gpt-4o"

# DeepSeek / Moonshot / Zhipu AI etc.
base_url: "https://api.deepseek.com/v1"
api_key: "your-key"
model_name: "deepseek-chat"

Static analysis

No suspicious patterns detected.