m5stack-uiflow2-coder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.13

Overview

This skill is a coherent UIFlow2 coding helper with bundled documentation and examples; the main caution is that some example programs use network services or device features when a user chooses to run them.

Install this if you want a documentation-backed assistant for UIFlow2/M5Stack MicroPython. Before running generated or copied examples on a device, review any network endpoints, avoid public unauthenticated MQTT for real data, disable IP geolocation if you do not want the device public IP sent to ipwho.is, and provide Wi-Fi or service credentials only when you intend the device code to use them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: assets/examples/m5ui/weather_320x240.py:28

Finding

Default Third-Party IP Geolocation Discloses Device Network Metadata

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (331)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is a coding assistant for UIFlow2 MicroPython development, implying advisory/help functionality around code generation, debugging, API selection, and documentation use. The supplied code does not implement assistant behavior at all. It is an end-user/device application: it initializes M5Stack UI components, connects to Wi‑Fi, queries external services for IP-based location and weather data, and draws a live weather interface with periodic refresh and button handling. These are materially different primary purposes and add undeclared capabilities involving network access, external HTTP communication, and location inference. This is not merely an example snippet for the assistant’s knowledge base in the abstract; the actual code chunk itself behaves as a weather app, not as a coding assistant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents this skill as a documentation-aware coding assistant for UIFlow2 MicroPython, implying advisory or code-generation behavior. The supplied code does not implement an assistant at all; it is an embedded example application. It initializes M5Stack hardware, creates a display canvas, reads accelerometer data from the IMU, registers Button A/B callbacks, updates simulation state in a loop, and renders an hourglass animation. These are materially different primary behaviors from assisting with writing or reviewing code. While the code is related to UIFlow2 and M5Stack, its function is to execute an application on-device, not to provide developer assistance, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents this skill as a coding assistant for generating or explaining UIFlow2 MicroPython code. The supplied code is not assistant logic at all; it is an executable device application example. Its primary purpose is to run a weather display on M5Stack hardware, including drawing graphics, handling Button A presses, reusing or establishing Wi‑Fi, and fetching live weather data from Open-Meteo every 15 minutes. Those are materially different behaviors and capabilities from a documentation-backed coding assistant. The undeclared external network access and runtime device interaction make this a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- 示例与需求冲突时以用户需求和当前官方文档为准，并明确需要重新硬件验证的部分。
- 只有经开发者确认适合作为标准参考的示例才会进入该目录；硬件验证状态以清单为准，未标明时不得声称已经过真机测试。

<!-- BEGIN_EXAMPLE_ROUTING -->
## 示例选择判定

只有当请求满足下表一行的全部客观条件时，才读取对应例程作为结构参考；不满足时不要为了形式加载示例，命中多行时可读取多个。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- 示例与需求冲突时以用户需求和当前官方文档为准,并明确需要重新硬件验证的部分。
- 只有经开发者确认适合作为标准参考的示例才会进入该目录;硬件验证状态以清单为准,未标明时不得声称已经过真机测试。

<!-- BEGIN_EXAMPLE_ROUTING -->
## 示例选择判定

只有当请求满足下表一行的全部客观条件时,才读取对应例程作为结构参考;不满足时不要为了形式加载示例,命中多行时可读取多个。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

以下文件树随文档同步自动更新；先根据这里定位文件，再读取对应 docs/... 原文。

text

docs/  (356 Markdown files, 22 directories; .md suffix omitted)
Rule: an entry like unit/env means docs/unit/env.md; entries ending in / are directories.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/base/atom_gps.md (reported line 75)May include surrounding context.

• Parameter id (int): The UART ID to use (0, 1, or 2). Default is 2.
• Parameter port: A list or tuple containing the TX and RX pin numbers.
• Type of port: list | tuple
• Parameter debug (bool): Whether to enable debug mode. Default is False.

python

from machine import UART

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/base/dtu_lorawan.md (reported line 86)May include surrounding context.

• Parameter id (int): The UART ID to use (0, 1, or 2). Default is 2.
• Parameter port: A list or tuple containing the TX and RX pin numbers.
• Type of port: list | tuple
• Parameter debug (bool): Whether to enable debug mode. Default is False.

python

from machine import UART

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/base/dtu_lorawan.md (reported line 198)May include surrounding context.

• Parameter id (int): The UART ID to use (0, 1, or 2). Default is 2.
• Parameter port: A list or tuple containing the TX and RX pin numbers.
• Type of port: list | tuple
• Parameter debug (bool): Whether to enable debug mode. Default is False.

python

from machine import UART

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/base/dtu_lorawan_rui3.md (reported line 188)May include surrounding context.

• Parameter id (int): The UART ID to use (0, 1, or 2). Default is 2.
• Parameter port: A list or tuple containing the TX and RX pin numbers.
• Type of port: list | tuple
• Parameter debug (bool): Whether to enable debug mode. Default is False.

python

from machine import UART

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/module/commu.md (reported line 114)May include surrounding context.

• Parameter id (int): The UART ID to use (0, 1, or 2). Default is 2.
• Parameter port: A list or tuple containing the TX and RX pin numbers.
• Type of port: list | tuple
• Parameter debug (bool): Whether to enable debug mode. Default is False.

python

from machine import UART

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/module/lorawan_rui3.md (reported line 135)May include surrounding context.

• Parameter id (int): The UART ID to use (0, 1, or 2). Default is 2.
• Parameter port: A list or tuple containing the TX and RX pin numbers.
• Type of port: list | tuple
• Parameter debug (bool): Whether to enable debug mode. Default is False.

python

from machine import UART

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The MQTT example connects to a public broker on port 1883 with no TLS, authentication, or warning that messages are exposed to third parties. This can lead to eavesdropping, message injection, topic abuse, and accidental data leakage, especially because users may assume official examples are safe defaults.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 19)May include surrounding context.

md

import os, sys, io
import M5
from M5 import *
from chain import KeyChain
from chain import ChainBus
from usb.device.keyboard import Keyboard
from usb.device.hid import KeyCode

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 40)May include surrounding context.

md

import os, sys, io
import M5
from M5 import *
from chain import KeyChain
from chain import ChainBus
from usb.device.keyboard import Keyboard
from usb.device.hid import KeyCode

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 78)May include surrounding context.

md

import os, sys, io
import M5
from M5 import *
from chain import KeyChain
from chain import ChainBus
from usb.device.keyboard import Keyboard
from usb.device.hid import KeyCode

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 81)May include surrounding context.

md

import os, sys, io
import M5
from M5 import *
from chain import KeyChain
from chain import ChainBus
from usb.device.keyboard import Keyboard
from usb.device.hid import KeyCode

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 186)May include surrounding context.

md

import os, sys, io
import M5
from M5 import *
from chain import KeyChain
from chain import ChainBus
from usb.device.keyboard import Keyboard
from usb.device.hid import KeyCode

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 81)May include surrounding context.

from chain import KeyChain

chainbus_0 = ChainBus(2, 32, 33, verbose=True) keychain_0 = KeyChain(chainbus_0, 1)

text

### `get_button_state`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 91)May include surrounding context.

from chain import KeyChain

chainbus_0 = ChainBus(2, 32, 33, verbose=True) keychain_0 = KeyChain(chainbus_0, 1)

text

### `get_button_state`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 102)May include surrounding context.

from chain import KeyChain

chainbus_0 = ChainBus(2, 32, 33, verbose=True) keychain_0 = KeyChain(chainbus_0, 1)

text

### `get_button_state`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 105)May include surrounding context.

from chain import KeyChain

chainbus_0 = ChainBus(2, 32, 33, verbose=True) keychain_0 = KeyChain(chainbus_0, 1)

text

### `get_button_state`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 116)May include surrounding context.

from chain import KeyChain

chainbus_0 = ChainBus(2, 32, 33, verbose=True) keychain_0 = KeyChain(chainbus_0, 1)

text

### `get_button_state`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 119)May include surrounding context.

from chain import KeyChain

chainbus_0 = ChainBus(2, 32, 33, verbose=True) keychain_0 = KeyChain(chainbus_0, 1)

text

### `get_button_state`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/chain/key.md (reported line 130)May include surrounding context.

from chain import KeyChain

chainbus_0 = ChainBus(2, 32, 33, verbose=True) keychain_0 = KeyChain(chainbus_0, 1)

text

### `get_button_state`

Static analysis

No suspicious patterns detected.