Sports Game Light Tracker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:42 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent sports-to-smart-light purpose, but it asks users to run a hidden auto-restarting PowerShell tracker with Home Assistant credentials and an overbroad forced stop command.

Install only if you are comfortable giving this workflow Home Assistant control of the specified light and running a background PowerShell process. Prefer a dedicated least-privileged Home Assistant token, restrict the config file permissions, require an HTTPS/local trusted Home Assistant URL, run the tracker visibly, and stop only recorded process IDs rather than using the documented broad force-kill command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:113

Finding

Insecure plaintext handling of a Home Assistant bearer token and unvalidated endpoint

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 113–124
Vulnerability Type: Plaintext sensitive credential handling and insufficient endpoint validation
Risk Level: Medium

Vulnerable Code

powershell

$config = Get-Content ".homeassistant-config.json" | ConvertFrom-Json
$token = $config.token
$url = $config.url

Technical Analysis

The Skill instructs the Agent to load a Home Assistant API token directly from a plaintext JSON file. It also loads the destination URL from the same configuration without requiring HTTPS, validating the server identity, restricting the URL to an approved Home Assistant host, or defining appropriate file permissions.

Access to a Home Assistant token is relevant to controlling Hue lights, but plaintext storage and an unrestricted endpoint exceed the minimum safe implementation requirements. If the configuration file is readable or modifiable by another local user or process, the token may be stolen or the destination may be replaced with an attacker-controlled endpoint.

The actual game-tracker.ps1 implementation is absent from the project. Therefore, this audit cannot confirm that the token is transmitted, logged, or otherwise exposed by the referenced script. The confirmed issue is the insecure credential-management design prescribed by the Skill documentation.

Attack Path

1. An attacker or compromised local process obtains read or write access to .homeassistant-config.json.
2. For credential theft through local access, the attacker reads the plaintext token value directly.
3. Alternatively, the attacker changes the configured url to an endpoint under their control.
4. The user starts the tracker according to the documented workflow.
5. If the absent tracker script authenticates to the configured URL without validating it, the Home Assistant bearer token may be sent to the attacker-controlled endpoint.
6. The attacker reuses the token against ...[truncated 577 chars]

Remediation

View remediation

Remediation Suggestions

• Store the token in an operating-system credential manager or another dedicated secret store rather than a plaintext project file.
• If a configuration file remains necessary, exclude it from version control and restrict its filesystem permissions to the owning user.
• Separate non-sensitive endpoint configuration from secret material.
• Require HTTPS for non-loopback connections and preserve certificate validation.
• Validate the configured URL against an explicit allowlist of approved Home Assistant hosts and ports.
• Use a dedicated, least-privileged Home Assistant account or token limited to the required light entities and service calls.
• Ensure the tracker never prints the token in logs, command lines, errors, or status messages.
• Document token rotation and revocation procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:127

Finding

Hidden self-restarting PowerShell supervisor reduces execution visibility and control

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127–135
Vulnerability Type: Unsafe hidden background process execution
Risk Level: Medium

Vulnerable Code

powershell

Start-Process powershell -ArgumentList "-File keeper.ps1 -TrackerScript 'game-tracker.ps1'" -WindowStyle Hidden

Technical Analysis

The Skill directs the Agent to launch a hidden PowerShell process that acts as an automatic restart supervisor for another script. Continuous monitoring is consistent with the declared functionality, but hiding the process and automatically restarting the tracker reduces user awareness and makes execution harder to inspect or terminate reliably.

The command uses relative script paths and does not demonstrate canonical path validation, script integrity verification, process-ID tracking, a maximum restart count, or a bounded execution period. If an attacker can replace either script or influence the working directory, the supervisor could repeatedly execute unintended PowerShell code.

This behavior is not confirmed system persistence under T06 because the documentation does not install a startup item, service, scheduled task, or other mechanism that survives a reboot or user session. It is nevertheless an insecure execution pattern within the active session.

Attack Path

1. The user follows the Skill workflow and starts the keeper with a hidden window.
2. The process resolves keeper.ps1 and game-tracker.ps1 using relative paths.
3. An attacker with write access to the relevant directory replaces one of the referenced scripts, or causes execution from a directory containing a malicious script with the expected name.
4. The hidden keeper launches the substituted tracker code.
5. If the tracker exits, the keeper may launch it again, resulting in repeated execution until the process is discovered and stopped.

This path requires local filesystem influence. The referenced scripts are absent f ...[truncated 502 chars]

Remediation

View remediation

Remediation Suggestions

• Run the tracker visibly by default and require explicit user consent before enabling background operation.
• Avoid -WindowStyle Hidden; provide a visible status indicator, logs, and a clear stop control.
• Resolve and validate absolute paths for both scripts before launch.
• Verify script integrity or signatures before every restart.
• Record the exact process IDs returned by Start-Process -PassThru.
• Impose a maximum runtime, bounded restart count, and backoff between failures.
• Stop restarting after authentication failures, invalid configuration, or repeated crashes.
• Run the process under a dedicated least-privileged account where practical.
• Include the actual scripts in the package so their behavior can be reviewed before use.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:143

Finding

Broad command-line matching can forcibly terminate unrelated PowerShell processes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 143–148
Vulnerability Type: Unsafe process selection and forced termination
Risk Level: Medium

Vulnerable Code

powershell

Get-Process powershell | Where-Object { $_.CommandLine -like "*game-tracker.ps1*" -or $_.CommandLine -like "*keeper.ps1*" } | Stop-Process -Force

Technical Analysis

The stop command selects every PowerShell process whose command line contains either script-name substring and then forcibly terminates all matches. Substring matching does not prove that a process is the tracker created by this Skill. An unrelated administrative task, development session, or automation process can be selected if its arguments contain one of these names.

The use of Stop-Process -Force prevents graceful cleanup and can interrupt file writes, API operations, or other state changes. The command does not validate a recorded process ID, process start time, parent process, canonical script path, or ownership relationship.

Attack Path

1. A legitimate unrelated PowerShell process starts with a command line containing game-tracker.ps1 or keeper.ps1; this could occur in a path, log-processing argument, editor operation, test command, or another script invocation.
2. The user executes the documented tracker stop command.
3. The wildcard filter matches both the intended tracker and the unrelated process.
4. Stop-Process -Force terminates every matched process without graceful shutdown or confirmation.
5. The unrelated task loses in-memory state or leaves partially completed operations.

A local attacker could also deliberately include the matching text in another process command line to cause disruption or confusion when the user runs the stop procedure, although the primary risk is accidental overmatching.

Impact Assessment

The command can terminate unrelated processes running within the caller's permitted process-control scope. ...[truncated 274 chars]

Remediation

View remediation

Remediation Suggestions

• Capture and securely retain the exact process IDs when launching the tracker and keeper.
• Stop only those recorded process IDs after verifying process ownership, start time, executable path, and canonical script path.
• Request graceful termination first and use forced termination only after a defined timeout.
• Avoid broad command-line substring matching.
• If process discovery is unavoidable, require an exact canonical script path and additional identifying metadata.
• Display the selected processes and request confirmation before terminating more than the expected tracker processes.
• Clean up stored process metadata after confirmed termination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes continuous score polling, automatic light-control actions, and use of a stored Home Assistant token, but it does not clearly warn users that it will run persistently in the background and repeatedly access home-automation credentials and APIs. In a smart-home context, missing disclosure reduces informed consent and can surprise users with ongoing device control and external/network activity beyond a one-time action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The stop command forcefully kills PowerShell processes whose command lines match broad patterns, without warning that this may terminate other legitimate sessions or scripts containing the same names. In this context, an overbroad forced stop can cause accidental denial of service or data loss in unrelated PowerShell work, especially because it uses Stop-Process -Force.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.