ClawHub
Back to skill

Security audit

Teslamate Skills

Security checks for vulnerabilities and agentic risk

Overview

This TeslaMate skill appears legitimate, but it needs review because it can expose exact vehicle locations to external services and can run raw SQL through Grafana.

Install only if you trust the Grafana datasource permissions and are comfortable with exact vehicle locations and destinations being sent to external geocoding/routing services. Use a read-only, least-privilege Grafana datasource account, avoid the raw-SQL fallback, and prefer self-hosted or HTTPS-validated geocoding/routing before using location or route features.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/query_teslamate.py:111
Finding

TLS Certificate Validation Disabled for Geocoding Requests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/query_teslamate.py:215
Finding

Precise Vehicle Coordinates Transmitted to Routing Service over Plaintext HTTP

Content
View full analysis
`. 2. The skill queries TeslaMate for the vehicle's latest exact latitude and longitude. 3. The destination is converted into another pair of coordinates. 4. Both coordinate pairs are embedded in an HTTP request to `router.project-osrm.org`. 5. A network observer captures the plaintext URL and learns the vehicle's current position and intended destination. 6. An active attacker may modify the OSRM response and provide a forged route distance or duration. 7. The skill uses the manipulated response to calculate and display travel time, energy requirements, and expected arrival range. ### I ...[truncated 629 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/query_teslamate.py:1161
Finding

Unrestricted Raw SQL Execution Through Command-Line Fallback

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented purpose says the skill queries TeslaMate data, but the behavior expands into third-party geocoding, route planning, current-location enrichment, and raw SQL execution against Grafana. This mismatch is dangerous because users and reviewers may authorize the skill for benign telemetry access while it can exfiltrate sensitive vehicle location data to outside services or run broader-than-expected database queries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The query() function accepts and forwards raw SQL directly to Grafana's datasource API, and the CLI falls back to executing arbitrary user-provided text as SQL. That exceeds the advertised purpose of predefined vehicle-status retrieval and can expose unrelated database contents, enable destructive queries if the backend permits them, or bypass intended product restrictions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is described as querying TeslaMate data via Grafana, but it additionally transmits precise vehicle coordinates and user-supplied destinations to external services such as Nominatim and OSRM. This creates an undisclosed data exfiltration path for highly sensitive location history and trip intent, which is especially dangerous given the personal nature of vehicle telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The current vehicle location functionality discloses exact coordinates to an external reverse-geocoding service as part of producing a friendly address, but the user is not informed that third parties will receive this telemetry. In the context of a car-tracking skill, this is a significant privacy and security issue because location data can directly identify the user's movements and habits.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The location() feature retrieves the car's latest latitude/longitude and immediately calls get_position_address(), which sends those precise coordinates to Nominatim without any warning or consent flow. Vehicle location is highly sensitive personal data, and sending it to a third party can expose home/work locations and live whereabouts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly advertises access to sensitive vehicle telemetry, trip history, current location, and reverse-geocoded addresses, but it does not warn users that this data is privacy-sensitive or recommend access controls and careful sharing. In the context of a vehicle-monitoring skill, exposing location history and frequent places can reveal home/work patterns and daily routines, increasing stalking, surveillance, or household security risks if logs, screenshots, or workspace access are shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states that Nominatim and OSRM are used for reverse geocoding and routing, but it does not warn that vehicle-related location data may be transmitted to third-party services. Because this skill handles precise trip and place information, undisclosed outbound sharing can leak highly sensitive travel patterns to external operators and may violate user expectations or privacy requirements.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents network-dependent behavior but does not declare any tool scope or permission boundaries. That makes its actual capabilities under-specified, increasing the risk of unintended external access, hidden data flows, and unsafe deployment in environments that rely on manifest-level restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill handles location, charging, state, and trip telemetry, which is sensitive personal data, but the description does not warn about privacy exposure through the Grafana API or downstream services. Without clear disclosure, operators may expose a Grafana instance or share outputs without understanding the surveillance and physical-security implications of vehicle telemetry leakage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The route-planning feature goes beyond passive TeslaMate querying and introduces transmission of user-supplied destinations and likely vehicle context to external routing services. In a vehicle telemetry skill, that broadening of scope matters because it can expose highly sensitive travel patterns that are not obvious from the manifest description.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/query_teslamate.py (reported line 13)May include surrounding context.

python
def load_config():
    config_path = CONFIG_PATH.replace("~", str(__import__("os").path.expanduser("~")))
    try:
        with open(config_path) as f:
            return json.load(f)

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/query_teslamate.py (reported line 20)May include surrounding context.

python
except FileNotFoundError:
        # Try legacy config location
        legacy_path = "~/.openclaw/workspace/memory/teslamate-status.json"
        legacy_path = legacy_path.replace("~", str(__import__("os").path.expanduser("~")))
        try:
            with open(legacy_path) as f:
                data = json.load(f)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The reverse-geocoding helpers enable transformation of raw coordinates into human-readable current and historical places, which is more privacy-invasive than generic vehicle statistics. In a Tesla telemetry skill, exposing place history can reveal home, workplace, routines, and other sensitive patterns beyond what the manifest narrowly promises.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Many user-facing strings are hard-coded in Chinese, including table headers, status messages, and reports, while the script provides no option to select another language or any note that it is intended only for a Chinese-speaking context. This creates a language policy issue because the locale is effectively forced without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The README content and example interaction phrases are entirely in Chinese, and the usage section instructs users to interact with the skill using Chinese phrases only. This can be a language-policy issue when a skill imposes a specific language without documenting user choice or regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The only route example uses a Chinese destination string ("广州珠江新城"), which can imply a preferred language or locale in the skill's natural-language interface without documenting that the skill is region-specific or optional. Under the language/locale policy, examples should not effectively force a specific language unless the locale constraint is explicit and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.