The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts execute shell commands using subprocess.run with shell=True while directly interpolating variables derived from CLI arguments or parameters. This pattern is vulnerable to shell command injection on the host system if the input (such as phone numbers, coordinates, or element descriptions) contains shell metacharacters.
Files: scripts/karrot_keyboard_flow.py, scripts/karrot_keyboard_flow_v2.py, scripts/karrot_safe_tap.py, scripts/bluestacks_manager.py, and scripts/karrot_resilient_tap.py.
Example: subprocess.run(f"adb shell {cmd}", shell=True) where cmd includes unsanitized user-provided text.
[DATA_EXFILTRATION]: A specific South Korean phone number (01039705176) is hardcoded as a constant and default value across numerous configuration and script files. This represents an exposure of personal data in the skill's source code.
Files: config/karrot_states.toon, scripts/karrot_workflow.py, workflow/karrot-banned-zones.toon, and others.
[INDIRECT_PROMPT_INJECTION]: The automation logic captures device screen content and UI hierarchy dumps, which are sent to an external AI vision API for semantic analysis. The prompts used for analysis lack boundary markers or instructions to ignore embedded content, creating a vulnerability where text or UI elements displayed by a malicious app on the device could influence the agent's logic or bypass its safety protocols.
Files: scripts/karrot_ai_vision.py and scripts/karrot_smart_detector.py.
[DYNAMIC_EXECUTION]: Several scripts dynamically modify the module search path using sys.path.insert(0, ...) to load local modules from computed paths at runtime.
Files: scripts/karrot_test_ai.py and scripts/karrot_workflow.py.
[EXTERNAL_DOWNLOADS]: The test runner script downloads and executes an installation script from a well-known developer tool service domain via a shell pipe.
File: scripts/run_tests.sh fetches from astral.sh and pipes to sh.

adb-karrot