Security audit

Android Adb Skill

Security checks for vulnerabilities and agentic risk

Overview

This ADB skill is useful for Android debugging but needs review because it can change or erase data on a connected device without explicit confirmation.

Install only if you are comfortable with an agent operating ADB on connected Android devices. Before using it, require explicit approval for installs, uninstalls, data clearing, reboots, file writes, wireless ADB changes, and any command containing user-provided paths or package names.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:39
Finding: Destructive ADB Operations May Execute Without Explicit Confirmation
Content: View full analysis
` parameter to all subsequent commands | ``` The skill then exposes destructive operations without defining any operation-specific confirmation boundary: ```bash # Uninstall while retaining data adb [-s ] shell pm uninstall -k # Complete uninstall adb [-s ] uninstall ``` ```bash adb [-s ] shell pm clear ``` ```bash # Normal reboot adb [-s ] reboot # Reboot into Recovery adb [-s ] reboot recovery # Reboot into Bootloader adb [-s ] reboot bootloader ``` ### Technical Analysis The skill applies a blanket rule that operations should execute immediately whenever exactly one Android device is connected. It does not distinguish read-only diagnostics from state-changing or destructive commands. Commands such as `pm clear`, complete package removal, and device reboot can cause irreversible data loss or operational disruption. Device count is not an adequate authorization mechanism: detecting one device identifies a target but does not establish that the user has approved the exact destructive action. This is an insecure skill configuration because the workflow omits an explicit confi ...[truncated 1408 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:74
Finding: Unvalidated Parameters in Shell Command Templates Permit Command Injection
Content: View full analysis
# Specific device adb -s install -r # Common parameters: # -r Allow replacement while retaining data # -d Allow downgrade # -g Automatically grant runtime permissions # -t Allow installation of test APKs ``` Other affected templates include: ```bash PID=$(adb [-s ] shell pidof ) adb [-s ] logcat --pid=$PID adb [-s ] logcat -s :V adb [-s ] logcat | grep ``` ```bash adb [-s ] shell pm list packages | grep adb [-s ] shell dumpsys package ``` ```bash adb [-s ] push adb [-s ] pull ``` ### Technical Analysis The command templates interpolate paths, serial numbers, package names, tags, and search keywords directly into shell command strings. The instructions do not require quoting, strict validation, option termination, or argument-array execution. If an agent constructs these commands through a shell, metacharacters contained in a supplied value may be interpreted as shell syntax rather than as part of a single argument. Relevant syntax includes command separators, command substitution, pipes, redirections, glob characters, and newline characters. Path fields are especially exposed because legitimate paths may contain spaces and because an attacker can provide a crafted path as part of an installation, push, or pull request. The `grep ` templates also directly place a potentially user-controlled search expression into a pipeline. Parameters beginning with `-` can additionally cause option injec ...[truncated 1920 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger rules are extremely broad and include common conversational phrases like “试一下”, “看看效果”, and “帮我装一下”, causing the skill to activate in many ordinary Android-related contexts. Because this skill can perform real device operations via ADB, over-triggering increases the chance of unintended installation, logging, file transfer, app control, or other sensitive actions without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly says that if exactly one device is connected, the skill should directly execute commands without user confirmation. In this skill’s context, that is dangerous because supported commands include uninstall, clear app data, reboot, file push/pull, APK install with powerful flags, and shell operations that can alter device state or destroy user data; a single connected device does not imply consent or correct targeting.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.