Control Ikea Lightbulb

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:38 AM UTC
• Version: 1.0.1

Overview

This skill transparently controls a user-specified smart bulb on the local network, with no evidence of hidden persistence or unrelated data access.

Before installing, confirm the target IP belongs to the bulb you intend to control, expect visible changes to that device when commands run, and consider adding a reviewed lockfile or pinned dependency if you need reproducible installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:5

Finding

Unpinned Runtime Dependency Without Lockfile or Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: pyproject.toml:5-7; execution occurs through scripts/run_control_kasa.sh:6-7 and scripts/run_test_light_show.sh:10-11
Vulnerability Type: Supply-chain exposure caused by non-reproducible dependency resolution
Risk Level: Medium

Vulnerable Code — pyproject.toml:5-7:

toml

dependencies = [
  "python-kasa>=0.10.2",
]

Relevant Execution Code — scripts/run_control_kasa.sh:6-7:

bash

if command -v uv >/dev/null 2>&1; then
  exec uv run --project "$ROOT_DIR" python "$SCRIPT" "$@"
fi

Relevant Execution Code — scripts/run_test_light_show.sh:10-11:

bash

if command -v uv >/dev/null 2>&1; then
  exec uv run --project "$ROOT_DIR" python "$SCRIPT" "$@"
fi

Technical Analysis

The project declares python-kasa>=0.10.2 without an upper or exact version constraint. No reviewed lockfile or dependency hash verification is present in the audited project. Both shell wrappers invoke uv run, which may resolve and install a dependency version before running the Python scripts.

This means the effective third-party code can change between executions even when the Skill's source files remain unchanged. A newly published version satisfying the broad constraint may therefore be installed without being covered by the Skill's original review. The package name is consistent with the imported kasa library, and the project does not configure a suspicious package index; exploitation consequently requires compromise or malicious publication through the applicable upstream package supply chain.

Attack Path

1. An attacker compromises the relevant upstream package publication channel or causes a malicious package release satisfying python-kasa>=0.10.2 to become available through the configured package source.
2. A user invokes scripts/run_control_kasa.sh or scripts/run_test_light_show.sh in an environ ...[truncated 996 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate and commit a reviewed uv.lock file so dependency resolution is reproducible.
2. Change both wrappers to enforce locked resolution, for example:

   bash

   exec uv run --locked --project "$ROOT_DIR" python "$SCRIPT" "$@"
   

3. Pin or narrowly constrain python-kasa to versions that have been tested and reviewed, where operationally practical.
4. Perform dependency upgrades through an explicit review process that includes changelog inspection, provenance validation, vulnerability scanning, and regression testing.
5. Use package hashes or other integrity and provenance controls supported by the deployment workflow.
6. Run the Skill with least privilege and restrict filesystem and network access to only what is required for local bulb control.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/light_show.py (reported line 353)May include surrounding context.

python

await apply_color(dev, h, s, v, instant, double_write, white_temp)
        await asyncio.sleep(sleep_time)

    # finished — restore saved state
    log('show finished; restoring saved state', force=True)
    if fade and fade>0:
        await fade_restore(dev, saved, fade, steps=max(6, int(fade*10)), double_write=double_write)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill controls physical devices on the local network but does not clearly warn users that running it will change a real bulb’s state. That omission can lead to unintended device manipulation, surprise activation, or confusion in shared environments, especially when users assume the skill is only a simulation or test utility.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.