Security audit

m5stack-assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed M5Stack support helper that queries M5Stack's official MCP service and does not show hidden persistence, credential theft, destructive actions, or unrelated authority.

Install only if you are comfortable sending M5Stack support queries to mcp.m5stack.com. Redact credentials, Wi-Fi passwords, customer data, private logs, serials, and proprietary code before using the MCP search or answer tools.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description describes a full-featured M5Stack support/development assistant with mandatory behavior: it must use official MCP knowledge_search or knowledge_answer as evidence sources and must proactively file feedback via knowledge_feedback when information is missing or broken. The supplied code does not implement an assistant at all; it is only a lightweight MCP client wrapper for one tool path. It connects to the official M5Stack MCP service, initializes, lists tools, and calls knowledge_search. There is no logic for answering user questions across the described domains, no use of knowledge_answer, no feedback submission behavior, and no troubleshooting/escalation workflow. While the implemented knowledge_search access is consistent with part of the description, the actual behavior is materially narrower than the declared primary purpose and omits required capabilities, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description is written as a directive in Chinese and presents the core rule without any indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in should be flagged unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language descriptions and user-facing strings are written exclusively in Chinese, including the function description and demo output, without offering a language choice or documenting that the skill is intentionally Chinese-only. This can violate language/locale policy when users are not given an opt-in or alternative.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest says the assistant must first use the official MCP's knowledge_search or knowledge_answer to obtain evidence, and must proactively submit reproducible feedback through knowledge_feedback when materials are missing, incorrect, broken, or the tool fails. This implementation only drives the MCP protocol far enough to call knowledge_search and contains no path for knowledge_answer or knowledge_feedback, so the implemented behavior is narrower than the documented skill behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code sends the raw user query to https://mcp.m5stack.com without any in-band disclosure, consent gate, or minimization logic. In an assistant context, users may include proprietary code, credentials, serial numbers, or debugging logs, so silent transmission to a third-party service can create an avoidable privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The function sends the caller-provided query to an external service at mcp.m5stack.com over HTTPS, but this file contains no user-facing notice, consent flow, or data-minimization control. In a support assistant, queries may include proprietary code, device identifiers, credentials, or other sensitive troubleshooting data, so silent exfiltration to a third party creates a real privacy and data-handling risk even if transport encryption is used.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-facing help text, status messages, and errors are all hard-coded in Chinese throughout the script. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all headings, explanations, and comments in Chinese, which can impose a specific language on users without any opt-in or stated regional justification. Under the policy rule for natural-language violations, forcing a language or locale without user choice is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language descriptions and comments present the skill entirely in Chinese, including the stated purpose and parameter descriptions, without offering any language choice or documenting that the skill is intended only for a Chinese-speaking context. This can violate a language/locale policy when users are not given an opt-in or alternative locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.