Security audit

skill-create-pip

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it handles Ecovacs account credentials and live robot-control commands with too little containment.

Review before installing. Use only with an account and machine you trust, because the helper can control a physical robot and stores reusable Ecovacs authentication material locally. Avoid putting real passwords or MD5 password values in shell history, delete or lock down `~/.ecovacs_session.json` after use, and prefer a revised version that prompts for credentials, stores only minimal tokens with 0600 permissions, validates command hostnames, and restricts commands to an allowlist with confirmation for persistent or disruptive actions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ecovacs.py:59
Finding: Reusable account credentials are stored without enforced access restrictions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ecovacs.py:97
Finding: Bearer token can be transmitted to an insufficiently validated API-provided hostname
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ecovacs.py:139
Finding: Login credentials are accepted through command-line arguments
Content: View full analysis
``` ### Technical Analysis The script requires the password or reusable MD5 password representation to be supplied as a command-line argument. Command-line arguments can be exposed through: - Shell history files. - Process-listing utilities while the process is running. - Terminal session recording. - CI/CD and automation logs. - Debugging, telemetry, or process-accounting systems. - Wrapper scripts that record executed commands. Accepting an MD5 value does not mitigate this issue because the Ecovacs API accepts that value as an authentication credential. An exposed hash can therefore be replayed without recovering the original plaintext password. ### Attack Path 1. The user follows the documented login command and supplies a plaintext password or MD5 password value. 2. The shell records the complete command in its history, or another local user observes the process arguments. 3. An attacker with access to the history, process metadata, or automation logs retrieves the credential. 4. The attacker calls the Ecovacs authentication endpoint using the captured phone number and password value. 5. The attacker receives a valid token and uses it to discover and control devices associated with the account. ### Impact Assessment The exposed credential may allow repeated authentication rather than access limited to one short-lived session. An attacker could obtain the victim's Ecovacs account privileges, including device discovery, status retrieval, map or schedule access where supported, cleaning control, a ...[truncated 172 chars]
Remediation: View remediation
") password = getpass("Ecovacs password: ") login(args[1], password) ``` 3. Update `SKILL.md` and the module usage documentation to show: ```bash python3 scripts/ecovacs.py login ``` 4. For non-interactive automation, accept credentials through a protected standard-input channel or an operating-system credential store rather than an environment variable or command argument. 5. Warn users to remove legacy commands containing credentials from shell history and rotate credentials if they were logged. 6. Avoid supporting direct MD5 values where possible; if the protocol mandates MD5, compute it in memory immediately before authentication and discard it afterward. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill performs network access to a cloud IoT API and writes session material to disk, but the manifest does not declare any permissions or allowed tool scope. That weakens least-privilege boundaries and makes it harder for a host or reviewer to understand and constrain what the skill can do, especially since it can issue live device-control actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description emphasizes convenience features but does not clearly warn that it can send live commands to a physical robot and persist changes such as schedules or operational modes. In an agent setting, that omission increases the chance of accidental or insufficiently authorized actions affecting the physical environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation states that token, userid, and resource are stored in ~/.ecovacs_session.json but does not warn about the sensitivity of that file or advise on protections. If the local environment is shared or compromised, an attacker could reuse the session material to control devices or query account-linked device information without needing the password again.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented cmd interface allows arbitrary command names and payloads to be sent to the robot API, going beyond the enumerated safe operations in the skill description. This expands the attack surface to undocumented or higher-risk device actions, including schedule changes or other state-altering commands, and bypasses intent-level validation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference explicitly instructs clients to authenticate by sending a plaintext identifier and an MD5-hashed password to a remote service. MD5 is not suitable for password protection because it is fast and vulnerable to offline cracking if captured or logged, and documenting this flow without warnings or stronger compensating controls normalizes insecure credential handling. In the context of a robot-control skill, compromise could allow unauthorized control of physical devices and exposure of account-linked device metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script persists both the API token and the user's password hash in a predictable file under the home directory, with no permission hardening or warning to the user. Any local process or attacker with access to that file can reuse the token or stored password hash to control the user's robot account and devices, and the script itself uses the stored password to silently re-authenticate when the token expires.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The login request fixes the account context to country="CN" and org="ECOCN", and the device request also hard-codes language fields elsewhere. The file does not present this as an optional or justified region-specific behavior, so it imposes a locale/region choice without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The quick reference table switches to Chinese for operational descriptions and parameter meanings, while the rest of the document is primarily in English. This can impose a language constraint on users without opt-in or a documented locale justification, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.