pp-tesla
Enables Tesla owners to manage vehicle features and charging costs through a JSON-first CLI, enhancing efficiency and analytics.
Install this skill
or
79/100
Security score
The pp-tesla skill was audited on Jun 10, 2026 and we found 5 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
medium line 416
Webhook reference - potential data exfiltration
SourceSKILL.md
| 416 | | `webhook:<url>` | POST the output body to the URL (`application/json` or `application/x-ndjson` when `--compact`) | |
medium line 418
Webhook reference - potential data exfiltration
SourceSKILL.md
| 418 | Unknown schemes are refused with a structured error naming the supported set. Webhook failures return non-zero and log the URL + HTTP status on stderr. |
low line 306
Access to hidden dotfiles in home directory
SourceSKILL.md
| 306 | tesla-http-proxy -key-file ~/.config/tesla-pp-cli/private.pem -port 4443 -cert auto & |
medium line 362
Access to hidden dotfiles in home directory
SourceSKILL.md
| 362 | Run `tesla auth login` and the CLI opens Tesla's real login page in your browser. Log in there (Tesla owns MFA, captcha, SMS codes - we never see them), Tesla redirects you to a 404 page on auth.tesla |
medium line 404
Access to hidden dotfiles in home directory
SourceSKILL.md
| 404 | Entries are stored locally at `~/.tesla-pp-cli/feedback.jsonl`. They are never POSTed unless `TESLA_FEEDBACK_ENDPOINT` is set AND either `--send` is passed or `TESLA_FEEDBACK_AUTO_SEND=true`. Default |
Scanned on Jun 10, 2026
View Security Dashboard