Smart Home Hub

• Outcome: Pass
• Latest audit: Jun 13, 2026 at 3:44 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed smart-home control skill with safety-sensitive capabilities, but the artifacts are coherent and do not show hidden code, persistence, exfiltration, or deceptive behavior.

Install only if you are comfortable giving an agent access to smart-home platforms. Configure least-privilege API tokens where possible, require confirmations for locks, alarm state, cameras, and automation edits, and review where any scene backups are stored.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill exposes broad natural-language triggers such as device control, security status, and door-camera access without defining strict activation boundaries, identity checks, or disambiguation rules. In a smart-home context, ambiguous triggering can cause unintended execution of safety- and privacy-sensitive actions, including controlling locks, arming/disarming security, or revealing camera information from casual or spoofed phrasing.

VirusTotal

63/63 vendors flagged this skill as clean.