T05 · Unauthorized Access and Privilege Escalation
Error
- Location
claw.json:169- Finding
Sensitive device information can be accessed without user confirmation
- Content
View full analysis
- Remediation
View remediation
Security audit
图图智控（TUTU Smart Control）
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-built for Android remote control, but it needs Review because several sensitive reads and device-changing actions are not clearly gated and some safety claims contradict the exposed tools.
Install only if you understand that this can remotely view and control a connected Android phone through a third-party service. Before use, verify every sensitive action yourself, avoid pasting TUTU_API_TOKEN or serial numbers into chat, and treat screenshots, notifications, files, logs, screen recordings, and setting changes as sensitive even when the platform does not show a confirmation prompt.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
claw.json:323- Finding
Ungated device reconnaissance enables detailed profiling
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
claw.json:224- Finding
High-impact device mutations and screen recording are not confirmation-gated
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:835- Finding
Mandatory workflow contradicts the environment-only credential policy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (40)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger set contains broad everyday terms that are likely to match ordinary conversations, causing this highly privileged remote-control skill to activate unintentionally. In the context of a phone-control skill with access to screenshots, messages, files, calls, and settings, accidental invocation materially raises the chance of privacy-invasive or destructive actions being proposed or executed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The capability descriptions enumerate access to sensitive data and powerful actions—SMS, contacts, call logs, GPS, notifications, screenshots, files, app management, and network controls—without consistently placing user-facing warnings and consent requirements adjacent to each capability. Because this skill operates on a personal mobile device, weak inline disclosure increases the risk of users not understanding the privacy and safety implications of activation.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill claims it has no system-setting write capability and only supports read-only queries, yet it exposes multiple mutating actions such as set_brightness, set_volume, set_rotation, set_wifi, set_bluetooth, set_airplane_mode, set_screen_timeout, and set_wallpaper. This is dangerous because users and downstream reviewers may rely on false safety claims while the skill can materially alter device state and availability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description and all invocation guidance are written as mandatory Chinese-language instructions for using the skill, while also including generic English triggers like "phone" and "android". There is no statement that the skill is China-only or Chinese-only, nor any opt-in or alternative language support, which creates a locale-policy concern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill transmits device control commands and highly sensitive artifacts such as screenshots to an external service endpoint, which is an actual external data transmission path. In this context, screenshots can reveal messages, MFA codes, contacts, and other private content, so the external transmission is security-relevant even if it is the intended architecture.
- Content
1. 截图 — 查看手机当前屏幕
bash curl -s -X POST https://www.szs.chat/api/phone_action.php \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TUTU_API_TOKEN" \ -d '{"action":"screenshot"}'
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow says the user must provide a Token and SN, but earlier sections explicitly say the token is injected from the environment and SN is unnecessary. This inconsistency can cause the agent to solicit credentials in chat, increasing the risk of secret exposure and mishandling of device identity data.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document says there is no unlock capability and only read-only lock-state inspection, but an example explicitly instructs waking the screen and swiping up to bypass simple lock screens. Even if this does not defeat PIN/password locks, it still contradicts the stated trust boundary and can enable interaction with an unsecured device without clearly communicating that behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes remote control, GUI automation, system management, communications, and reading device state, but does not justify falsifying device state for other apps. Mock-location injection is a distinct capability that can influence external app behavior and is not an obvious requirement for normal phone control.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The manifest emphasizes remote Android control, GUI automation, communications, status, and sandboxed file operations on existing device storage. Downloading arbitrary files from URLs introduces a content-ingestion capability that is not clearly described as part of the skill’s purpose and is broader than local file management.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description is written entirely in Chinese, including setup, safety guidance, and usage instructions, with no indication that alternative languages are available. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 95% confidence
- Finding
The trigger '手机' is extremely broad and likely to appear in many unrelated conversations. Because this skill grants remote control over an Android device, even low-friction accidental activation increases privacy and safety risk.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 93% confidence
- Finding
The trigger '微信' is a common app name that may appear in ordinary discussion unrelated to remote device control. For a privileged phone-control skill, this creates unnecessary activation risk.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 93% confidence
- Finding
The trigger '抖音' is a common everyday term in user chats and can invoke the skill without clear automation intent. That is unsafe given the skill's high privileges over phone state and content.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 92% confidence
- Finding
The trigger '淘宝' is too generic for a high-privilege control skill and may match benign shopping discussions. This broadens the attack surface for accidental invocation.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 92% confidence
- Finding
The trigger '京东' is a common app or shopping reference and does not by itself express intent to control a device. Accidental matching is therefore plausible.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 91% confidence
- Finding
The trigger '电量' is a generic term that can appear in many contexts, causing overbroad activation. For a skill with access to phone telemetry and controls, this is an avoidable risk.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 92% confidence
- Finding
The trigger '短信' is broad and can match ordinary discussion about text messages without indicating consent to access device SMS data. That is especially sensitive in this skill's context.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 91% confidence
- Finding
The trigger '定位' is a common term that may be used abstractly or conversationally, yet this skill can access live GPS location. Broad matching therefore increases privacy risk.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 91% confidence
- Finding
The trigger '位置' is even broader than '定位' and may appear in many non-device-control contexts. This can accidentally route users into a skill with sensitive location access.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
The trigger '通知' is generic and could match many unrelated requests about notifications conceptually rather than phone access. Given the skill can read system notifications, accidental invocation carries privacy implications.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 89% confidence
- Finding
The trigger '震动' is a short everyday term that does not inherently indicate a request to control a phone remotely. This weakens intent verification.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 88% confidence
- Finding
The trigger '语音' is highly generic and may match many unrelated discussions. In a skill that can perform TTS and broader phone control, that is unnecessarily permissive.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 88% confidence
- Finding
The trigger '媒体' is broad and ambiguous, making unintentional activation plausible. This is avoidable for a high-privilege skill.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 89% confidence
- Finding
The trigger '存储' is generic and often used outside remote-phone-control contexts. With file-management capabilities, accidental routing could expose private data handling flows.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
The trigger '截图' is a common term that may refer to many platforms or contexts, not necessarily controlling a connected Android device. This can cause unintended activation of a sensitive skill.
- Content
Static analysis
No suspicious patterns detected.