Framebuffer Dump

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:36 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it helps an agent dump an STM32 device framebuffer through J-Link and convert it to a local PNG, with some disclosed but manageable data-exposure and reliability risks.

Install and use this only when you are authorized to inspect the connected device screen. Treat the raw framebuffer dump and PNG as potentially sensitive, choose output paths deliberately, delete captures when no longer needed, and prefer a pinned Pillow version in a dedicated Python environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: README.md:14
• Finding: Unpinned Third-Party Dependency Installation< (`JLinkExe` in PATH) - Python 3.8+ with [Pillow](https://pypi.org/project/Pillow/): `pip install Pillow` ``` ### Technical Analysis The documented installation command asks users to install Pillow without specifying an audited version or verifying a package hash. Consequently, the package version resolved by `pip` can change over time without any corresponding change to the reviewed project. This does not prove that Pillow itself is malicious. However, relying on a mutable, unverified dependency makes builds non-reproducible and increases exposure to upstream package compromise, malicious future releases, compromised package distribution infrastructure, or unexpected compatibility and security regressions. ### Attack Path 1. A user follows the installation instructions in `README.md`. 2. The user runs `pip install Pillow`. 3. `pip` resolves whichever Pillow release is current and compatible at that time. 4. If the selected distribution or its delivery path has been compromised, package installation or subsequent import can execute attacker-controlled code under the user's account. 5. That code receives the same filesystem, network, and process privileges available to the Python environment in which it runs. ### Impact Assessment Successful supply-chain exploitation could execute code with the privileges of the user performing the installation or running the framebuffer conversion script. The potential scope includes access to files and credentials readable by that account, network access available to the process, and modification of the active Python environment. No direct privilege escalation, malicious dependency, or active compromise was identified in the audited project. The find ...[truncated 63 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Declare Pillow in a dependency file using an explicitly reviewed version, for example: ```text Pillow==<reviewed-version> ``` 2. Generate and record cryptographic hashes for the approved distribution artifacts. 3. Install dependencies with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Review and update the pinned version through a controlled dependency-update process. 5. Prefer installation inside a dedicated virtual environment with only the permissions needed for image conversion. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/dump_fb.py:22
• Finding: Unbounded Input File and Image Dimension Memory Consumption<![CDATA[ ## Vulnerability Details **File Location**: `scripts/dump_fb.py:22-27` **Vulnerability Type**: Uncontrolled resource consumption **Risk Level**: Low ### Vulnerable Code Snippet ```python need = args.width * args.height * args.stride data = in_path.read_bytes() if len(data) < need: raise SystemExit(f"input too small: got {len(data)} bytes, need >= {need}") raw = data[:need] ``` ### Technical Analysis `Path.read_bytes()` loads the entire selected input file into process memory, although the converter only uses the first `need` bytes. There is no maximum input-file size check before this allocation. The command-line values for `width`, `height`, and `stride` are also accepted without positive-value or upper-bound validation. Extremely large positive values can produce a very large `need` value and cause substantial allocations during slicing or image creation. Invalid negative or zero values can also produce inconsistent behavior and uncontrolled exceptions. Because input paths and image dimensions are command-line parameters, this issue is exploitable when an untrusted user can influence invocation arguments or provide the framebuffer file. ### Attack Path 1. An attacker or untrusted automation supplies a path to an extremely large local file through `--in`, or supplies extreme positive values through `--width`, `--height`, and `--stride`. 2. The script invokes `in_path.read_bytes()` and attempts to load the complete file into memory. 3. If the calculated size is accepted, subsequent slicing and Pillow image construction can cause additional memory consumption. 4. The Python process may become unresponsive, be terminated by the operating system, or contribute to memory pressure affecting other processes. The attacker must be able to influence the script arguments or the referenced input file. The script does not expose a network service by itself. ### Impact Assessment The primary impact is local availability loss. Exploitation can termin ...[truncated 321 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require positive, reasonable upper bounds for width, height, and stride. 2. Reject calculated framebuffer sizes above a documented maximum. 3. Inspect the file size with `stat()` before reading and reject unexpectedly large inputs. 4. Open the file and read only the required number of bytes instead of calling `read_bytes()`: ```python MAX_DIMENSION = 8192 MAX_FRAMEBUFFER_BYTES = 256 * 1024 * 1024 if not (1 <= args.width <= MAX_DIMENSION): raise SystemExit("width is outside the permitted range") if not (1 <= args.height <= MAX_DIMENSION): raise SystemExit("height is outside the permitted range") if args.stride != 3: raise SystemExit("only RGB888 stride 3 is supported") need = args.width * args.height * args.stride if need > MAX_FRAMEBUFFER_BYTES: raise SystemExit("requested framebuffer is too large") file_size = in_path.stat().st_size if file_size < need: raise SystemExit( f"input too small: got {file_size} bytes, need >= {need}" ) if file_size > MAX_FRAMEBUFFER_BYTES: raise SystemExit("input file is too large") with in_path.open("rb") as stream: raw = stream.read(need) ``` 5. Run conversion jobs with operating-system memory and execution-time limits when processing untrusted files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README encourages installing and using the skill with automation but does not clearly warn that the workflow reads live device framebuffer memory and writes screen contents to local dump files. That omission can lead users to expose sensitive on-screen data such as credentials, PII, proprietary UI states, or secrets displayed during debugging, especially when an agent performs the steps automatically.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill instructs reading local template and script files and handling arbitrary file paths, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap: an agent may infer it can use filesystem capabilities more broadly than intended, increasing the risk of unintended file access or writing dumps/logs to sensitive locations.

Static analysis

No suspicious patterns detected.