Control Ikea Lightbulb

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:38 AM UTC
• Version: 1.0.1

Overview

This skill transparently controls a user-specified smart bulb on the local network, with no evidence of hidden persistence or unrelated data access.

Before installing, confirm the target IP belongs to the bulb you intend to control, expect visible changes to that device when commands run, and consider adding a reviewed lockfile or pinned dependency if you need reproducible installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:5
• Finding: Unpinned Runtime Dependency Without Lockfile or Integrity Verification## Vulnerability Details **File Location**: `pyproject.toml:5-7`; execution occurs through `scripts/run_control_kasa.sh:6-7` and `scripts/run_test_light_show.sh:10-11` **Vulnerability Type**: Supply-chain exposure caused by non-reproducible dependency resolution **Risk Level**: Medium **Vulnerable Code — `pyproject.toml:5-7`:** ```toml dependencies = [ "python-kasa>=0.10.2", ] ``` **Relevant Execution Code — `scripts/run_control_kasa.sh:6-7`:** ```bash if command -v uv >/dev/null 2>&1; then exec uv run --project "$ROOT_DIR" python "$SCRIPT" "$@" fi ``` **Relevant Execution Code — `scripts/run_test_light_show.sh:10-11`:** ```bash if command -v uv >/dev/null 2>&1; then exec uv run --project "$ROOT_DIR" python "$SCRIPT" "$@" fi ``` ### Technical Analysis The project declares `python-kasa>=0.10.2` without an upper or exact version constraint. No reviewed lockfile or dependency hash verification is present in the audited project. Both shell wrappers invoke `uv run`, which may resolve and install a dependency version before running the Python scripts. This means the effective third-party code can change between executions even when the Skill's source files remain unchanged. A newly published version satisfying the broad constraint may therefore be installed without being covered by the Skill's original review. The package name is consistent with the imported `kasa` library, and the project does not configure a suspicious package index; exploitation consequently requires compromise or malicious publication through the applicable upstream package supply chain. ### Attack Path 1. An attacker compromises the relevant upstream package publication channel or causes a malicious package release satisfying `python-kasa>=0.10.2` to become available through the configured package source. 2. A user invokes `scripts/run_control_kasa.sh` or `scripts/run_test_light_show.sh` in an environ ...[truncated 996 chars]
• Remediation: ## Remediation Suggestions 1. Generate and commit a reviewed `uv.lock` file so dependency resolution is reproducible. 2. Change both wrappers to enforce locked resolution, for example: ```bash exec uv run --locked --project "$ROOT_DIR" python "$SCRIPT" "$@" ``` 3. Pin or narrowly constrain `python-kasa` to versions that have been tested and reviewed, where operationally practical. 4. Perform dependency upgrades through an explicit review process that includes changelog inspection, provenance validation, vulnerability scanning, and regression testing. 5. Use package hashes or other integrity and provenance controls supported by the deployment workflow. 6. Run the Skill with least privilege and restrict filesystem and network access to only what is required for local bulb control.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent

Content

await apply_color(dev, h, s, v, instant, double_write, white_temp)
        await asyncio.sleep(sleep_time)

    # finished — restore saved state
    log('show finished; restoring saved state', force=True)
    if fade and fade>0:
        await fade_restore(dev, saved, fade, steps=max(6, int(fade*10)), double_write=double_write)

• Confidence: 55% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill controls physical devices on the local network but does not clearly warn users that running it will change a real bulb’s state. That omission can lead to unintended device manipulation, surprise activation, or confusion in shared environments, especially when users assume the skill is only a simulation or test utility.

Static analysis

No suspicious patterns detected.