autojs-task-runner-yashu

This module is a clipboard-collection utility that conditionally performs off-device exfiltration: it reads clipboard contents, writes long clipboard text to external storage, and uploads it to a remote HTTP endpoint specified by /sdcard/脚本/relay_config.json, then broadcasts previews/metadata via an exit event. The combination of clipboard harvesting, configurable remote destination, plaintext HTTP upload, and storage of full clipboard text makes the security risk very high and consistent with malicious privacy/data theft rather than benign functionality.

This module performs sensitive device/app inventory collection (user-installed app labels) and exfiltrates it to a remote server specified by a local external-storage JSON config, using unencrypted HTTP multipart upload. It also embeds the full app inventory in the in-process broadcast result and may leave a local inventory artifact on failure. No overt malicious payload execution is visible, but the data-collection-and-transfer pattern is strongly privacy-invasive and should be treated as high security risk pending verification of the server endpoint, transport (prefer HTTPS), and broader workflow controls.

This module is centered on saving an icon to local storage and optionally uploading the saved file using uploadBytes(phonePath, outName), followed by broadcasting a JSON result on exit. The main security concerns are (1) possible exfiltration of a locally stored file due to the uploadBytes call and (2) potential leakage of device-local file paths and app/package identifiers through a broadcast event (and respText in failure notes). The fragment itself shows no overt backdoor/credential theft or obvious malicious runtime execution, but the external endpoint and intent of the upload are not visible, so risk cannot be fully bounded from this snippet alone.

This module is primarily an Android/AutoJS-style file upload/exfiltration utility. It selects an arbitrary local file from shared storage based on tamperable inputs in /sdcard/脚本/task_args.json (including deep recursive filename search and direct absolute-path support) and uploads the file contents to an HTTP endpoint configured in /sdcard/脚本/relay_config.json. While the code is not obfuscated and does not show explicit code-execution backdoors, its core behavior matches a high-risk data exfiltration pattern—especially because both the file target and remote destination are controlled via writable local JSON files and the transfer uses plain HTTP.

This module implements an upload-and-serve service backed by filesystem reads/writes. There are no direct malware indicators in the shown code (no execution primitives or network exfiltration). However, it can be security-relevant: it stores attacker-provided content on disk and later serves it to clients, and the /probe/* endpoint serves content as application/javascript. If an attacker can upload malicious content or reach/choose files under PROBE_ROOT, this can enable script delivery. Traversal and arbitrary file access risks appear mitigated by filename/path validation and containment checks, but correctness for symlinks/traversal handling relies on helper implementations not shown. Add/verify strong authorization for upload and read routes and ensure the helper functions fully prevent escape via traversal and symlinks.

This module is an operational deployment/update orchestrator. It does not show classic malicious indicators (no obfuscation, no credential theft, no direct exfiltration in this file), but it enables high-impact behavior: selecting an arbitrary local script via --path, sending it through a companion helper to a fixed Android location, and then triggering a restart/self-update via a potentially unauthenticated, plain-HTTP relay endpoint (unless secured elsewhere). The primary security uncertainty is outside this file: the trustworthiness and safety controls of pc_to_phone.js and the relay/update service (authentication, integrity, and permissioning).

This module is a configurable remote-to-local file downloader/write agent. It does not show explicit code execution, credential theft, persistence, or covert data collection within the fragment. However, it can write attacker-controlled remote bytes to persistent SD-card storage, with only minimal validation (size check) and no authenticity/integrity protection, using plain HTTP. Additional weaknesses include partial filename sanitization with an unsafe fallback and an ensureDir implementation that may not correctly prepare the intended directory. Overall, the main risk is abuse for unwanted file delivery/tampering if local JSON inputs or the relay traffic can be influenced.

The provided fragment does not show classic indicators of malicious code, but it describes a powerful phone-to-PC arbitrary file retrieval and HTTP multipart upload mechanism. Because the caller can specify which existing file to locate (by filename with recursive search or by absolute path) and the tool can persist the uploaded content on the PC and return its absolute path, this should be treated as a sensitive exfiltration/backhaul capability. Risk is especially dependent on relay/server authentication/authorization and the integrity of the phone-side relay configuration that selects the upload destination. Implementation details are not included, so the assessment has limited certainty.

This is a system-management helper that enumerates processes listening on a TCP port and forcefully terminates them to free the port. No clear malware behaviors (exfiltration/persistence/stealth) are present in this snippet. However, it uses `execSync` and on non-Windows interpolates the caller-provided `port` directly into an `lsof` shell command, creating a potential command-injection risk if `port` is not strictly validated as a numeric port. Additionally, the use of `kill -9`/`taskkill /F` is highly destructive and should only operate on trusted, correctly authorized inputs.

No direct evidence of classic malware (obfuscated payloads, command execution, persistence, credential theft) can be confirmed because the provided content is specification/metadata rather than executable code. However, the described functionality captures the entire mobile screen and uploads the resulting PNG to a companion PC over HTTP and returns a local absolute path for further reading. This is inherently privacy-sensitive and functions as a screen-surveillance/exfiltration capability; its safety therefore depends entirely on strict consent/visibility, authenticated/authorized endpoint access, transport security (e.g., TLS), and minimization/redaction controls in the unseen implementation. Treat as a medium-to-high security and privacy risk pending verification of those controls.

No classic malware indicators (network exfiltration, persistence, obfuscation, or direct system compromise) are visible in this fragment. However, it is designed to enumerate all files in a hardcoded local Android directory and share them out to other apps via ACTION_SEND intents (EXTRA_STREAM). This creates a meaningful privacy/data-exfiltration risk if the receiving app is untrusted or if the user is tricked into selecting a recipient. The missing shareList implementation limits certainty about exact behavior, but the visible data flows strongly indicate bulk local file export through Android sharing.

该技能与其宣称的“AI 控制手机/AutoJS 任务执行”目的总体一致，未见明显凭据窃取、外部中转 API 或伪装安装链，因此不像恶意技能。但其实际权限很强：可远程执行手机脚本、连续自动操作、截屏/OCR、双向传文件、部署更新删除工程，属于高影响自动化工具；在缺少细粒度审批时更应视为高风险但非恶意。

This module is primarily a local interactive image/color-picker UI, but it contains a high-impact security primitive: it persists a function as a string and rehydrates/executes it via eval on the next run. If the persisted storage can be tampered with, this enables stored arbitrary code execution in the AutoJS environment. Secondary concerns include clipboard export of executable-looking JavaScript and privacy-impacting local media path enumeration/logging. No direct network exfiltration or system-destruction behavior is evident in the provided fragment; the security risk is driven by the eval-from-persistence pattern.

This fragment implements a high-risk remote execution controller for an AutoJS/Android environment. It takes externally supplied commands, writes attacker-controlled scripts/arguments to local storage, and executes them using engines.execScriptFile. It also executes a client script path derived from cmd.path and can delete directories derived from cmd.path/cmd.projectName with only a weak sdcard prefix constraint. While this could be intended for legitimate remote deployment, the absence of visible authentication/signing/allowlisting and the direct network-to-disk-to-exec flow makes it consistent with a backdoor/remote execution design and should be treated as dangerous in supply-chain contexts unless strong protections exist elsewhere.

The dominant security issue is the crop_screenshot capability: it captures the device screen, converts a cropped region to PNG bytes, and uploads them over HTTP to a companion server endpoint determined by on-device relay configuration. This creates a direct sensitive visual data exfiltration channel, and the returned server path is broadcast back to the orchestrator. Other UI automation/probing templates are comparatively lower risk, but when combined with server-driven template download/execution, the overall architecture presents a high supply-chain and privacy risk unless strong safeguards (destination allowlist, authenticated/encrypted transport, strict integrity for downloaded tasks, user-consent/minimization controls) are enforced. Because the snippet is truncated and some implementations are omitted, confidence is moderate regarding exact network hardening and conditional logic, but the described exfiltration path is clear.

This module is primarily an HTTP relay/controller for a connected phone. While it contains no explicit obfuscation or overt malware in the snippet, it provides a direct path from untrusted HTTP inputs (notably body.code) to a remote execution instruction sent via sendToPhone({action:'run', code,...}). If the endpoints are not strongly authenticated/authorized, this constitutes a high-impact remote code execution/command-and-control risk and also enables potential denial-of-service via /shutdown. Malware probability is therefore moderate (behaviorally risky, but intent/evidence of covert sabotage is not shown).

High privacy/security risk: this module captures screen content (cropped by user-provided coordinates), writes it to external storage, and uploads it over HTTP to an endpoint controlled by locally stored configuration. While there is no explicit obfuscation or in-module code execution, the screenshot-to-network transfer is a strong exfiltration indicator. Treat this script as sensitive and only deploy with strict trust controls over relay_config.json, network destination, and explicit user consent.

This module is a high-impact screenshot capture and upload component. It captures potentially sensitive on-screen content and exfiltrates it to an HTTP relay whose destination is determined by an external, user-writable configuration file on /sdcard. It contains minimal input hardening for the upload filename but does not protect the primary risk (screen content exfiltration) and does not secure transport (plain HTTP). There are no clear signs of traditional malware techniques like code injection, persistence mechanisms, or credential theft within this fragment; however, the implemented functionality directly enables surveillance/exfiltration if the relay server (or config) is malicious or compromised.