Security audit

Framebuffer Dump

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it helps an agent dump an STM32 device framebuffer through J-Link and convert it to a local PNG, with some disclosed but manageable data-exposure and reliability risks.

Install and use this only when you are authorized to inspect the connected device screen. Treat the raw framebuffer dump and PNG as potentially sensitive, choose output paths deliberately, delete captures when no longer needed, and prefer a pinned Pillow version in a dedicated Python environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

Location: README.md:14
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Generate and record cryptographic hashes for the approved distribution artifacts. 3. Install dependencies with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Review and update the pinned version through a controlled dependency-update process. 5. Prefer installation inside a dedicated virtual environment with only the permissions needed for image conversion. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/dump_fb.py:22
Finding: Unbounded Input File and Image Dimension Memory Consumption
Content: View full analysis
= {need}") raw = data[:need] ``` ### Technical Analysis `Path.read_bytes()` loads the entire selected input file into process memory, although the converter only uses the first `need` bytes. There is no maximum input-file size check before this allocation. The command-line values for `width`, `height`, and `stride` are also accepted without positive-value or upper-bound validation. Extremely large positive values can produce a very large `need` value and cause substantial allocations during slicing or image creation. Invalid negative or zero values can also produce inconsistent behavior and uncontrolled exceptions. Because input paths and image dimensions are command-line parameters, this issue is exploitable when an untrusted user can influence invocation arguments or provide the framebuffer file. ### Attack Path 1. An attacker or untrusted automation supplies a path to an extremely large local file through `--in`, or supplies extreme positive values through `--width`, `--height`, and `--stride`. 2. The script invokes `in_path.read_bytes()` and attempts to load the complete file into memory. 3. If the calculated size is accepted, subsequent slicing and Pillow image construction can cause additional memory consumption. 4. The Python process may become unresponsive, be terminated by the operating system, or contribute to memory pressure affecting other processes. The attacker must be able to influence the script arguments or the referenced input file. The script does not expose a network service by itself. ### Impact Assessment The primary impact is local availability loss. Exploitation can termin ...[truncated 321 chars]
Remediation: View remediation
MAX_FRAMEBUFFER_BYTES: raise SystemExit("requested framebuffer is too large") file_size = in_path.stat().st_size if file_size < need: raise SystemExit( f"input too small: got {file_size} bytes, need >= {need}" ) if file_size > MAX_FRAMEBUFFER_BYTES: raise SystemExit("input file is too large") with in_path.open("rb") as stream: raw = stream.read(need) ``` 5. Run conversion jobs with operating-system memory and execution-time limits when processing untrusted files. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README encourages installing and using the skill with automation but does not clearly warn that the workflow reads live device framebuffer memory and writes screen contents to local dump files. That omission can lead users to expose sensitive on-screen data such as credentials, PII, proprietary UI states, or secrets displayed during debugging, especially when an agent performs the steps automatically.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs reading local template and script files and handling arbitrary file paths, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap: an agent may infer it can use filesystem capabilities more broadly than intended, increasing the risk of unintended file access or writing dumps/logs to sensitive locations.
Content: No source excerpt is available for this finding.