安卓手机自动化，类似豆包手机

• Outcome: Review
• Latest audit: May 28, 2026 · 8:22 AM UTC
• Version: 1.0.0

Overview

This is a coherent phone-automation skill, but it needs review because it can change the host setup, remember device connection details, use model API keys, and perform real phone actions with limited preflight confirmation.

Install only if you intentionally want an agent to set up tooling and control a real phone. Use it on a trusted single-user machine, review the package and repo changes before first run, avoid sensitive logged-in accounts unless you are supervising, and treat API keys and remembered device Wi-Fi targets as sensitive local data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print('[phase] model verification')
    py = venv_python(repo_dir)
    verify = subprocess.run([
        str(py), str(root_dir / 'scripts' / 'verify_open_autoglm.py'),
        '--base-url', os.environ.get('MODEL_BASE_URL', ''),
        '--model', os.environ.get('MODEL_NAME', ''),

• Confidence: 84% confidence
• Finding: verify = subprocess.run([ str(py), str(root_dir / 'scripts' / 'verify_open_autoglm.py'), '--base-url', os.environ.get('MODEL_BASE_URL', ''), '--model', os.environ.get('MODE

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

system = platform.system()
    if system == 'Darwin' and shutil.which('brew'):
        for formula in ['python@3.12', 'python@3.11', 'python@3.10']:
            rc = subprocess.run(['brew', 'install', formula]).returncode
            if rc == 0 and select_python():
                return True
        return False

• Confidence: 92% confidence
• Finding: rc = subprocess.run(['brew', 'install', formula]).returncode

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return False
    if system == 'Windows' and shutil.which('winget'):
        for pkg in ['Python.Python.3.12', 'Python.Python.3.11', 'Python.Python.3.10']:
            rc = subprocess.run(['winget', 'install', '--id', pkg, '--accept-package-agreements', '--accept-source-agreements']).returncode
            if rc == 0 and select_python():
                return True
        return False

• Confidence: 93% confidence
• Finding: rc = subprocess.run(['winget', 'install', '--id', pkg, '--accept-package-agreements', '--accept-source-agreements']).returncode

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

print('[phase] model verification')
    py = venv_python(repo_dir)
    verify = subprocess.run([
        str(py), str(root_dir / 'scripts' / 'verify_open_autoglm.py'),
        '--base-url', os.environ.get('MODEL_BASE_URL', ''),
        '--model', os.environ.get('MODEL_NAME', ''),

• Confidence: 91% confidence
• Finding: verify = subprocess.run([ str(py), str(root_dir / 'scripts' / 'verify_open_autoglm.py'), '--base-url', os.environ.get('MODEL_BASE_URL', ''), '--model', os.environ.get('MODE

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation examples are broad, ordinary natural-language phone-assistance requests, and the skill explicitly says to treat them as end-to-end execution requests rather than informational queries. This increases the chance of unintended invocation, causing the agent to initiate device automation, repo setup, network access, or other side effects when the user may have only wanted advice or planning help.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to clone or update repositories, install dependencies, reuse environment variables, and reconnect devices automatically, while explicitly avoiding up-front disclosure unless a blocker occurs. Those are system-modifying and potentially security-sensitive actions that can change the host state and connect to external resources without informed user consent.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The code persistently stores device identifiers and Wi‑Fi addresses under the user's home directory without any notice, consent, retention control, or permission hardening. In a device-management skill, this creates a privacy and local information exposure risk because other local users, backup systems, or tools may access a history of connected devices.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The function is explicitly designed to install Python automatically via brew or winget with no built-in warning, consent prompt, or policy check. Given this skill's product-grade deployment context, that behavior is more dangerous than in a purely local admin script because an automation agent may execute it as part of setup, causing unexpected host changes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.