Philips Hue

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:57 PM UTC
• Version: 1.0.1

Overview

This Philips Hue skill is mostly purpose-aligned, but its script has input-handling flaws that can allow local code execution in normal use paths.

Review before installing. Use only trusted color values, keep the skill directory and .env writable only by you, and assume the Hue API username can be exposed to devices able to observe your local network. A safer version should validate hex colors, pass values to Python as data, parse .env without executing it, and document the HTTP credential exposure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: hue.sh:37
• Finding: Arbitrary Python Code Execution Through Unvalidated Hexadecimal Color Input<![CDATA[ ## Vulnerability Details **File Location**: `hue.sh`, lines 37–48 and 85–98 **Vulnerability Type**: Python source-code injection **Risk Level**: High ### Vulnerable Code ```sh hex_to_hsb() { hex=$(echo "$1" | sed 's/#//') python3 - <<EOF import colorsys hex_color = "$hex" r, g, b = tuple(int(hex_color[i:i+2], 16) / 255.0 for i in (0, 2, 4)) h, s, v = colorsys.rgb_to_hsv(r, g, b) # Hue is 0-65535, Sat is 0-254, Bri is 0-254 print(f"\"on\":true,\"hue\":{int(h * 65535)},\"sat\":{int(s * 254)},\"bri\":{int(v * 254)}") EOF } ``` The attacker-controlled value reaches this function through the following code: ```sh case "$1" in red) HEX="#FF0000" ;; blue) HEX="#0000FF" ;; green) HEX="#00FF00" ;; yellow) HEX="#FFFF00" ;; orange) HEX="#FFA500" ;; pink) HEX="#FFC0CB" ;; purple) HEX="#800080" ;; white) HEX="#FFFFFF" ;; # Use hex for white and colors, but keep specialized CT for warm/cold warm) HSB="\"on\":true,\"sat\":0,\"bri\":254,\"ct\":450" ;; cold) HSB="\"on\":true,\"sat\":0,\"bri\":254,\"ct\":153" ;; \#*) HEX="$1" ;; *) echo "Unknown color: $1" ; exit 1 ;; esac if [ -n "$HEX" ]; then HSB=$(hex_to_hsb "$HEX") unset HEX fi ``` ### Technical Analysis Every color argument beginning with `#` is accepted by the `\#*` shell pattern. The code does not verify that the remainder is exactly six hexadecimal characters. After removing the first `#`, the value is interpolated directly into a Python heredoc: ```python hex_color = "$hex" ``` Because the value is inserted into Python source code rather than passed as data, an input containing quotation marks, statement separators, and a Python comment can terminate the string and introduce additional executable Python statements. The generated source is then execu ...[truncated 1623 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Strictly validate hexadecimal colors before processing them. Accept only exactly six hexadecimal digits following `#`: ```sh case "$1" in \#[0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f]) HEX="$1" ;; *) echo "Invalid hexadecimal color" >&2 exit 1 ;; esac ``` 2. Never interpolate external values into Python source code. Pass the color as an argument: ```sh hex_to_hsb() { python3 - "${1#\#}" <<'PY' import colorsys import re import sys hex_color = sys.argv[1] if not re.fullmatch(r"[0-9A-Fa-f]{6}", hex_color): raise SystemExit("Invalid hexadecimal color") r, g, b = ( int(hex_color[i:i + 2], 16) / 255.0 for i in (0, 2, 4) ) h, s, v = colorsys.rgb_to_hsv(r, g, b) print( f'"on":true,"hue":{int(h * 65535)},' f'"sat":{int(s * 254)},"bri":{int(v * 254)}' ) PY } ``` 3. Use a quoted heredoc delimiter such as `<<'PY'` to disable shell expansion within the Python source. 4. Retain validation in both the shell caller and Python implementation as defense in depth. 5. Add negative tests for quotation marks, whitespace, newlines, command syntax, incorrect lengths, and non-hexadecimal characters. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: hue.sh:8
• Finding: Arbitrary Shell Command Execution Through Sourced .env Configuration<![CDATA[ ## Vulnerability Details **File Location**: `hue.sh`, lines 8–13 **Vulnerability Type**: Unsafe configuration-file evaluation **Risk Level**: Medium ### Vulnerable Code ```sh SCRIPT_DIR="$(dirname "$0")" SCRIPT_DIR="$(cd "$SCRIPT_DIR" && pwd)" CONFIG_FILE="$SCRIPT_DIR/.env" if [ -f "$CONFIG_FILE" ]; then . "$CONFIG_FILE" fi ``` ### Technical Analysis The shell dot command (`.`) does not parse `.env` as a passive key-value configuration file. It executes the file as shell source code in the current process. Although the documentation describes `.env` as containing only `BRIDGE_IP` and `USERNAME` assignments, the implementation neither restricts the accepted keys nor rejects shell syntax. A modified `.env` can therefore contain command substitutions, function definitions, redirections, or arbitrary commands. Those commands run before the script processes the requested Hue operation. The file is resolved relative to the physical skill directory, which prevents a caller from selecting an arbitrary configuration path through the current working directory. However, any actor, package process, or compromised account able to modify the skill-local `.env` can convert the next legitimate invocation into command execution. ### Attack Path 1. An attacker obtains write access to the skill directory or its `.env` file. 2. The attacker inserts shell commands into `.env`, in addition to or instead of the expected assignments. 3. A user or agent invokes `hue.sh` for any operation. 4. The script executes `. "$CONFIG_FILE"`. 5. The attacker's commands run in the current shell with the invoking user's privileges. 6. Execution occurs before configuration validation or Hue API access, so even an otherwise invalid Hue command can trigger the payload. ### Impact Assessment The attacker gains command execution as the user running the skill. This can permit: - Reading and exfiltrating the Hue API username. - Reading or modifying other user-accessible files. - Alt ...[truncated 368 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not source `.env` as executable shell code. 2. Parse only an explicit allowlist of keys, such as `BRIDGE_IP` and `USERNAME`, and reject malformed or unexpected records. Values should be treated as data rather than evaluated by the shell. 3. Use a configuration format with a non-executing parser where practical, such as JSON parsed by `jq`, or read the required values from a protected credential store. 4. Validate both fields after parsing: - Require `BRIDGE_IP` to be a valid expected hostname or IP address. - Require `USERNAME` to match the Hue API username format expected by the deployment. - Reject control characters, whitespace where unsupported, URL delimiters, and shell metacharacters. 5. Restrict file permissions and verify ownership before reading the configuration. For example, require the file to be owned by the invoking user and inaccessible to other users. 6. Keep credentials outside writable package directories when the package may be updated or modified by other processes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: hue.sh:29
• Finding: Hue API Credential and Control Traffic Transmitted Over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `hue.sh`, lines 29–34 **Vulnerability Type**: Cleartext transmission of sensitive credentials and device-control traffic **Risk Level**: Medium ### Vulnerable Code ```sh url="http://$BRIDGE_IP/api/$USERNAME$path" if [ "$method" = "GET" ]; then curl -s -H "Connection: close" "$url" else curl -s -H "Connection: close" -X "$method" -d "$data" "$url" fi ``` ### Technical Analysis The script embeds the Hue API username in the URL and sends requests using unencrypted HTTP. Neither the credential, requested resource, device state, nor command body receives transport-layer confidentiality or integrity protection. An attacker capable of observing local-network traffic can recover the API credential and inspect device information or control commands. An active network attacker can also modify requests or responses, impersonate the bridge through network redirection, or replay observed commands where accepted. This risk is particularly relevant on shared, compromised, wireless, or otherwise untrusted local networks. The code does not warn the user about the cleartext credential transport or enforce network isolation. ### Attack Path 1. The user runs a status or light-control command. 2. The script constructs a URL containing `USERNAME` under the `/api/` path. 3. `curl` sends the URL and any command body over plaintext HTTP. 4. A network-positioned attacker captures or actively intercepts the request. 5. The attacker obtains the Hue API username from the request URL. 6. While able to reach the bridge, the attacker uses that credential to submit independent Hue API requests. 7. In an active interception scenario, the attacker may also alter control commands or return forged status information. ### Impact Assessment An attacker with suitable network visibility or interception capability may obtain: - The Hue API credential used by the skill. - Device identifiers, names, configuration, and cur ...[truncated 452 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use HTTPS with certificate verification when supported by the deployed Hue Bridge and API configuration. 2. Do not disable TLS certificate validation. Pin or trust the bridge certificate through an appropriate local trust mechanism if the bridge uses a private or self-signed certificate. 3. If API v1 over HTTP is unavoidable: - Clearly document that the credential is transmitted in plaintext. - Place the bridge and controller on a trusted, isolated network or VLAN. - Prevent untrusted wireless clients and guest-network devices from reaching the bridge. - Restrict bridge access with firewall rules to approved controller hosts. - Use a dedicated, revocable Hue API username and rotate it after suspected exposure. 4. Avoid logging complete request URLs because the credential is included in the path. 5. Consider migrating to a supported Hue API mode that provides authenticated encrypted transport where available. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

- A Philips Hue Bridge on the same local network.
- `curl`, `jq`, and `python3` installed on your system.

### 2. Configure .env file
Create a `.env` file in the skill directory:
```bash
BRIDGE_IP=192.168.1.XX  # Your bridge IP

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md`: This documentation.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

SCRIPT_DIR="$(dirname "$0")"
SCRIPT_DIR="$(cd "$SCRIPT_DIR" && pwd)"
CONFIG_FILE="$SCRIPT_DIR/.env"

if [ -f "$CONFIG_FILE" ]; then
  . "$CONFIG_FILE"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents shell-based capabilities and required binaries but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this creates an authorization gap: the skill may be able to invoke shell commands more broadly than a reviewer or runtime policy expects, increasing the chance of unintended command execution or abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

url="http://$BRIDGE_IP/api/$USERNAME$path"
  
  if [ "$method" = "GET" ]; then
    curl -s -H "Connection: close" "$url"
  else
    curl -s -H "Connection: close" -X "$method" -d "$data" "$url"
  fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.