ClawHub
Back to skill

Security audit

smarthome

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real smart-home controller, but it needs review because it can operate physical devices and handles long-lived smart-home credentials with weak safeguards.

Review this before installing if the account tokens can control important devices such as locks, heaters, outlets, cameras, or appliances. Use a narrowly scoped Home Assistant account, restrict the config file to owner-only access, prefer trusted local/official HTTPS endpoints, rotate credentials if endpoint settings were ever untrusted, and avoid broad fuzzy commands until the skill adds exact matching, confirmation, and platform-specific routing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/smart.py:25
Finding

Authentication Credentials Can Be Transmitted to Untrusted Configured Endpoints

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/smart.py:13
Finding

Ambiguous Device Resolution and Unconditional Cross-Platform Fallback Can Operate Unintended Devices

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
## Getting Home Assistant Token
1. Open Home Assistant → Profile (bottom left)
2. Scroll to "Long-Lived Access Tokens"
3. Click "Create Token" and name it (e.g., "Clawdbot")
4. Copy the token immediately (it is only displayed once)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · 说明文档.md (reported line 35)May include surrounding context.

md
## Getting Home Assistant Token
1. Open Home Assistant → Profile (bottom left)
2. Scroll to "Long-Lived Access Tokens"
3. Click "Create Token" and name it (e.g., "Clawdbot")
4. Copy the token immediately (it is only displayed once)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
Solution: Check the HA_URL and ensure Home Assistant is running and accessible.

### Error: 401 Unauthorized (HA)
Solution: The token has expired or is invalid. Generate a new Long-Lived Access Token.

### Device Not Responding
Solutions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · 说明文档.md (reported line 108)May include surrounding context.

md
Solution: Check the HA_URL and ensure Home Assistant is running and accessible.

### Error: 401 Unauthorized (HA)
Solution: The token has expired or is invalid. Generate a new Long-Lived Access Token.

### Device Not Responding
Solutions:

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The duplicated finding points to the same behavior: persistent storage of access tokens and API secrets in a local config file. Long-lived secrets stored unencrypted increase the blast radius of host compromise and make accidental disclosure through backups, screenshots, or file sharing more likely.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
设置
Option 1: Config File (Recommended)
选项1：配置文件（推荐）
Create ~/.config/universal-smarthome/config.json:
创建~/.config/universal-smarthome/config.json：

{

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The duplicated finding points to the same behavior: persistent storage of access tokens and API secrets in a local config file. Long-lived secrets stored unencrypted increase the blast radius of host compromise and make accidental disclosure through backups, screenshots, or file sharing more likely.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
设置
Option 1: Config File (Recommended)
选项1:配置文件(推荐)
Create ~/.config/universal-smarthome/config.json:
创建~/.config/universal-smarthome/config.json:

{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly supports fuzzy device-name matching for power-control actions, but the documentation does not warn users that ambiguous requests like "打开灯" may affect the wrong device. In a smart-home context, unintended control of lights, appliances, or other connected devices can create safety, privacy, or property risks even without malicious code.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script is explicitly capable of controlling smart-home devices through both Home Assistant and Tuya cloud APIs, which creates real-world impact beyond ordinary data processing. In the provided context there is no authentication, authorization, confirmation, or scope restriction around dangerous actions, so anyone able to invoke the script with valid config can trigger device state changes across local and cloud-connected systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/smart.py (reported line 35)May include surrounding context.

python
headers = {"Authorization": f"Bearer {ha['token']}"}

    try:
        r = requests.post(url, headers=headers, json={"entity_id": entity_id}, timeout=5)
        return r.status_code == 200
    except: return False

Tainted flow: 'headers' from requests.get (line 61, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/smart.py (reported line 35)May include surrounding context.

python
headers = {"Authorization": f"Bearer {ha['token']}"}

    try:
        r = requests.post(url, headers=headers, json={"entity_id": entity_id}, timeout=5)
        return r.status_code == 200
    except: return False

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The Tuya control path sends device commands to a third-party cloud service without any user-facing warning, approval step, or transparency about external transmission. In a smart-home context, undisclosed cloud control is security-relevant because it can affect physical devices and expose operational metadata to an external platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Several printed status and error messages are only presented in Chinese, with no option for users to select another language or locale. This is a natural-language policy concern because it forces a specific language without documented justification or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation describes direct control of real smart-home appliances but does not prominently warn about the physical-world consequences of turning devices on or off. In a home-automation context, ambiguous or mistaken commands can affect locks, heaters, ovens, lights, or other devices, creating safety, privacy, or property risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The recommended setup stores Home Assistant and Tuya credentials persistently in a local config file under the user's home directory. While common, persistent plaintext credential storage increases exposure if the host is compromised, backups are leaked, file permissions are weak, or other local users can read the file.

Content

Scanner excerpt · 说明文档.md (reported line 9)May include surrounding context.

Setup

Option 1: Config File (Recommended) Create ~/.config/universal-smarthome/config.json:

json
{

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · 说明文档.md (reported line 96)May include surrounding context.

md
## Common Issues & Solutions
### Error: Missing Configuration File
Solution: Create the file ~/.config/universal-smarthome/config.json

### Error: 1004: Invalid Signature
Solution: Check your Tuya access_id and access_secret. Ensure the endpoint matches your region (cn/com/us/eu).

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file presents the skill name and operational examples primarily in Chinese, including user utterances such as "打开客厅灯" and "打开灯", but it does not state that the skill is region-specific or provide language-choice guidance. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline comment says the real implementation would fetch devices from Home Assistant and Tuya and write them into CACHE_FILE, but the actual branch merely prints a success message. This is more than an omission because the user-visible output asserts synchronization happened when no such action occurs in this file.

Content

No source excerpt is available for this finding.