图图智控（TUTU Smart Control）

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:39 PM UTC
• Version: 1.3.3

Overview

The skill appears purpose-built for Android remote control, but it needs Review because several sensitive reads and device-changing actions are not clearly gated and some safety claims contradict the exposed tools.

Install only if you understand that this can remotely view and control a connected Android phone through a third-party service. Before use, verify every sensitive action yourself, avoid pasting TUTU_API_TOKEN or serial numbers into chat, and treat screenshots, notifications, files, logs, screen recordings, and setting changes as sensitive even when the platform does not show a confirmation prompt.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: claw.json:169
• Finding: Sensitive device information can be accessed without user confirmation<![CDATA[ ## Vulnerability Details **File Location**: `claw.json:169-171`, `claw.json:188-190`, `claw.json:335-337` **Vulnerability Type**: Missing authorization gates for sensitive data access **Risk Level**: High ### Complete Code Snippets ```json { "name": "read_notifications", "description": "Read system notification bar" } ``` ```json { "name": "read_file", "description": "Read file content from phone (restricted to /sdcard/ user storage only)" } ``` ```json { "name": "logcat", "description": "Read-only: retrieve filtered system log entries for troubleshooting (read-only, no system modification)" } ``` None of these tool definitions contains `"confirmation": true`. ### Technical Analysis The tools expose potentially sensitive Android data without requiring the platform-level confirmation mechanism used elsewhere in the project. Notifications may contain private messages, one-time passwords, authentication links, financial alerts, and account activity. Files under `/sdcard/` can include photographs, exported conversations, documents, downloads, and backups. Android logs may contain identifiers, application state, URLs, message fragments, or other diagnostic data. Restricting file access to `/sdcard/` and making log access read-only reduces integrity risk, but it does not address confidentiality. Because the tool results enter the Agent's execution context, private data may subsequently be summarized, displayed, retained in logs, or disclosed to an unintended requester. ### Attack Path 1. A request activates the phone-control Skill. 2. The Agent invokes `read_notifications`, `read_file`, or `logcat`. 3. The platform does not display a confirmation prompt because the tool lacks `"confirmation": true`. 4. The remote API retrieves sensitive data from the connected Android device. 5. The returned information enters the Agent context and may be exposed through its response or execution logs. ### Impact Assessment An Agent can obtain priva ...[truncated 354 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Add `"confirmation": true` to `read_notifications`, `read_file`, and `logcat`. - Require a separate confirmation for each sensitive file or data category rather than granting broad session-wide access. - Apply strict path canonicalization and allowlists to ensure file operations cannot escape `/sdcard/`. - Redact one-time passwords, bearer tokens, session identifiers, phone numbers, and message bodies by default. - Restrict log retrieval by application, severity, maximum line count, and approved diagnostic purpose. - Return metadata or summaries by default and expose full content only after explicit approval. - Record an auditable event containing the approved operation and scope without logging the sensitive returned content. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: claw.json:323
• Finding: Ungated device reconnaissance enables detailed profiling<![CDATA[ ## Vulnerability Details **File Location**: `claw.json:323-337`, `claw.json:374-376`; supporting workflow at `SKILL.md:1042-1048` **Vulnerability Type**: Excessive information disclosure and reconnaissance capability **Risk Level**: Medium ### Complete Code Snippets ```json { "name": "get_running_processes", "description": "Read-only: list running apps for diagnostics (no process control capability)" }, { "name": "get_battery_stats", "description": "Get detailed battery statistics" }, { "name": "logcat", "description": "Read-only: retrieve filtered system log entries for troubleshooting (read-only, no system modification)" } ``` ```json { "name": "get_wifi_list", "description": "Scan nearby WiFi networks" } ``` The documented system-information workflow instructs the Agent to collect device information, server information, running processes, battery statistics, and filtered logs and then compile them into a report. None of the listed reconnaissance tools is marked with `"confirmation": true`. ### Technical Analysis Running-process enumeration reveals which applications the user is actively using. Battery statistics may disclose usage patterns and application activity. Nearby WiFi scans expose SSIDs, signal strength, frequency, and encryption details associated with the user's physical environment. Log retrieval adds potentially sensitive diagnostic context. These operations can be combined into a detailed profile of the device, installed services, active applications, surroundings, and usage patterns. Although the individual tools are described as read-only, reconnaissance is itself security-sensitive because the aggregated result can support social engineering, targeted exploitation, physical-location inference, and follow-on attacks. ### Attack Path 1. The Skill is activated for a general diagnostic or status request. 2. The Agent follows the documented system-information workflow. 3. It calls device-information, process, ba ...[truncated 653 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Add `"confirmation": true` to `get_running_processes`, `get_wifi_list`, and `logcat`. - Consider confirmation for detailed battery statistics where application-level usage data is returned. - Separate low-sensitivity health summaries from detailed reconnaissance functions. - Return aggregate counts and health indicators by default rather than application names, SSIDs, or raw logs. - Redact BSSIDs, device identifiers, account-related process names, and sensitive log values. - Require the user to specify the diagnostic purpose and requested data categories. - Avoid automatically combining multiple reconnaissance sources unless the user explicitly approves the complete collection scope. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: claw.json:224
• Finding: High-impact device mutations and screen recording are not confirmation-gated<![CDATA[ ## Vulnerability Details **File Location**: `claw.json:224-228`, `claw.json:278-290`, `claw.json:384-403`, `claw.json:410-412` **Vulnerability Type**: Missing confirmation for disruptive, persistent, and privacy-sensitive operations **Risk Level**: High ### Complete Code Snippets ```json { "name": "force_stop_app", "description": "Force stop a running app", "parameters": { "package": { "type": "string", "required": true } } } ``` ```json { "name": "set_wifi", "description": "Enable or disable WiFi", "parameters": { "enabled": { "type": "boolean", "required": true } } }, { "name": "set_bluetooth", "description": "Enable or disable Bluetooth", "parameters": { "enabled": { "type": "boolean", "required": true } } } ``` ```json { "name": "set_screen_timeout", "description": "Set screen timeout duration (ms)", "parameters": { "timeoutMs": { "type": "integer", "required": true } } }, { "name": "push_notification", "description": "Push local notification to device", "parameters": { "title": { "type": "string", "required": true }, "text": { "type": "string", "required": true } } }, { "name": "set_wallpaper", "description": "Set wallpaper from device image file", "parameters": { "path": { "type": "string", "required": true } } } ``` ```json { "name": "record_screen", "description": "Record screen to MP4 on device (max 180s)" } ``` None of these operations is marked with `"confirmation": true`. The project documentation additionally claims that Android system settings are read-only and cannot be modified at `README.md:30` and `SKILL.md:1134`, even though `set_wifi`, `set_bluetooth`, `set_screen_timeout`, brightness, volume, rotation, and wallpaper tools modify device state. ### Technical Analysis These tools cross significant integrity, availability, and privacy boundaries: - `force_stop_app` can interrupt active applications and ongoing work. - `set_wifi` and `set_bluetoot ...[truncated 1492 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Add `"confirmation": true` to `force_stop_app`, `set_wifi`, `set_bluetooth`, `set_screen_timeout`, `set_wallpaper`, and `record_screen`. - Apply confirmation to other persistent or disruptive setting changes, including brightness, volume, and rotation where appropriate. - Show a persistent, user-visible indicator throughout screen recording. - Require an explicit recording duration and destination path, enforce the 180-second maximum server-side, and prevent background extension. - Constrain setting values with minimum and maximum bounds. - Provide automatic rollback for temporary network and display changes where feasible. - Correct the README and Skill security sections so they accurately disclose all writable settings. - Log approved mutations without recording sensitive screen content or credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:835
• Finding: Mandatory workflow contradicts the environment-only credential policy<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:89-108`, `SKILL.md:835-839` **Vulnerability Type**: Insecure and contradictory credential-handling instructions **Risk Level**: Medium ### Complete Code Snippets The token policy at `SKILL.md:89-108` states, in English: ```text The API Token is automatically injected through the TUTU_API_TOKEN environment variable and does not need to be manually provided or pasted by the user in the conversation. Security principles: - The Token is injected through an environment variable and is not transmitted or stored in the conversation. - The Token already contains encrypted device identity information, so the serial number does not need to be transmitted in plaintext. - Do not display the Token in logs or conversations. ``` The mandatory first-use workflow at `SKILL.md:835-839` states, in English: ```text Step 0: Verify the connection; mandatory on first use 1. Confirm that the user has provided the Token and SN. 2. Call status to verify that the device is online. 3. Call get_device_info to obtain basic device information. ``` These are faithful English renderings of the source instructions. ### Technical Analysis The first policy correctly defines an environment-variable injection model and prohibits transmitting the Token in conversation. The later mandatory workflow instructs the Agent to confirm that the user supplied both the Token and device serial number. An Agent following the mandatory workflow may ask the user to paste credentials into the conversation, even though the same file says that the Token is injected automatically and that no serial number is needed. Once entered into chat, credentials may be retained in model context, conversation history, telemetry, screenshots, support exports, or logs. Encryption of the Token's internal device identity does not make the bearer credential safe to disclose. Anyone who obtains a valid bearer token may be able to exercise the remote-device cap ...[truncated 988 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the first workflow step with: “Verify that `TUTU_API_TOKEN` is configured without reading, displaying, or requesting its value.” - Remove every instruction asking the user to provide an SN because the documented authentication model does not require it. - Explicitly prohibit echoing environment-variable values into responses, logs, diagnostic commands, screenshots, or error messages. - Use a redacted configuration-presence check that returns only configured/not-configured status. - Add automated linting to detect documentation that requests configured secret values in conversation. - Provide token rotation and revocation guidance for users who may already have pasted credentials into chat. - Ensure authentication failures instruct users to update the secret through the platform settings interface rather than through conversation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (40)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger set contains broad everyday terms that are likely to match ordinary conversations, causing this highly privileged remote-control skill to activate unintentionally. In the context of a phone-control skill with access to screenshots, messages, files, calls, and settings, accidental invocation materially raises the chance of privacy-invasive or destructive actions being proposed or executed.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The capability descriptions enumerate access to sensitive data and powerful actions—SMS, contacts, call logs, GPS, notifications, screenshots, files, app management, and network controls—without consistently placing user-facing warnings and consent requirements adjacent to each capability. Because this skill operates on a personal mobile device, weak inline disclosure increases the risk of users not understanding the privacy and safety implications of activation.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill claims it has no system-setting write capability and only supports read-only queries, yet it exposes multiple mutating actions such as set_brightness, set_volume, set_rotation, set_wifi, set_bluetooth, set_airplane_mode, set_screen_timeout, and set_wallpaper. This is dangerous because users and downstream reviewers may rely on false safety claims while the skill can materially alter device state and availability.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The description and all invocation guidance are written as mandatory Chinese-language instructions for using the skill, while also including generic English triggers like "phone" and "android". There is no statement that the skill is China-only or Chinese-only, nor any opt-in or alternative language support, which creates a locale-policy concern.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### 1. 截图 — 查看手机当前屏幕

```bash
curl -s -X POST https://www.szs.chat/api/phone_action.php \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TUTU_API_TOKEN" \
  -d '{"action":"screenshot"}'

• Confidence: 90% confidence
• Finding: The skill transmits device control commands and highly sensitive artifacts such as screenshots to an external service endpoint, which is an actual external data transmission path. In this context, screenshots can reveal messages, MFA codes, contacts, and other private content, so the external transmission is security-relevant even if it is the intended architecture.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The workflow says the user must provide a Token and SN, but earlier sections explicitly say the token is injected from the environment and SN is unnecessary. This inconsistency can cause the agent to solicit credentials in chat, increasing the risk of secret exposure and mishandling of device identity data.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document says there is no unlock capability and only read-only lock-state inspection, but an example explicitly instructs waking the screen and swiping up to bypass simple lock screens. Even if this does not defeat PIN/password locks, it still contradicts the stated trust boundary and can enable interaction with an unsecured device without clearly communicating that behavior.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The manifest describes remote control, GUI automation, system management, communications, and reading device state, but does not justify falsifying device state for other apps. Mock-location injection is a distinct capability that can influence external app behavior and is not an obvious requirement for normal phone control.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: The manifest emphasizes remote Android control, GUI automation, communications, status, and sandboxed file operations on existing device storage. Downloading arbitrary files from URLs introduces a content-ingestion capability that is not clearly described as part of the skill’s purpose and is broader than local file management.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The skill description is written entirely in Chinese, including setup, safety guidance, and usage instructions, with no indication that alternative languages are available. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 95% confidence
• Finding: The trigger '手机' is extremely broad and likely to appear in many unrelated conversations. Because this skill grants remote control over an Android device, even low-friction accidental activation increases privacy and safety risk.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 93% confidence
• Finding: The trigger '微信' is a common app name that may appear in ordinary discussion unrelated to remote device control. For a privileged phone-control skill, this creates unnecessary activation risk.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 93% confidence
• Finding: The trigger '抖音' is a common everyday term in user chats and can invoke the skill without clear automation intent. That is unsafe given the skill's high privileges over phone state and content.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 92% confidence
• Finding: The trigger '淘宝' is too generic for a high-privilege control skill and may match benign shopping discussions. This broadens the attack surface for accidental invocation.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 92% confidence
• Finding: The trigger '京东' is a common app or shopping reference and does not by itself express intent to control a device. Accidental matching is therefore plausible.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 91% confidence
• Finding: The trigger '电量' is a generic term that can appear in many contexts, causing overbroad activation. For a skill with access to phone telemetry and controls, this is an avoidable risk.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 92% confidence
• Finding: The trigger '短信' is broad and can match ordinary discussion about text messages without indicating consent to access device SMS data. That is especially sensitive in this skill's context.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 91% confidence
• Finding: The trigger '定位' is a common term that may be used abstractly or conversationally, yet this skill can access live GPS location. Broad matching therefore increases privacy risk.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 91% confidence
• Finding: The trigger '位置' is even broader than '定位' and may appear in many non-device-control contexts. This can accidentally route users into a skill with sensitive location access.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 90% confidence
• Finding: The trigger '通知' is generic and could match many unrelated requests about notifications conceptually rather than phone access. Given the skill can read system notifications, accidental invocation carries privacy implications.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 89% confidence
• Finding: The trigger '震动' is a short everyday term that does not inherently indicate a request to control a phone remotely. This weakens intent verification.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence
• Finding: The trigger '语音' is highly generic and may match many unrelated discussions. In a skill that can perform TTS and broader phone control, that is unnecessarily permissive.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence
• Finding: The trigger '媒体' is broad and ambiguous, making unintentional activation plausible. This is avoidable for a high-privilege skill.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 89% confidence
• Finding: The trigger '存储' is generic and often used outside remote-phone-control contexts. With file-management capabilities, accidental routing could expose private data handling flows.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 90% confidence
• Finding: The trigger '截图' is a common term that may refer to many platforms or contexts, not necessarily controlling a connected Android device. This can cause unintended activation of a sensitive skill.

Static analysis

No suspicious patterns detected.