ClawHub
Back to skill

Security audit

Philips Hue

Security checks for vulnerabilities and agentic risk

Overview

This Philips Hue skill is mostly purpose-aligned, but its script has input-handling flaws that can allow local code execution in normal use paths.

Review before installing. Use only trusted color values, keep the skill directory and .env writable only by you, and assume the Hue API username can be exposed to devices able to observe your local network. A safer version should validate hex colors, pass values to Python as data, parse .env without executing it, and document the HTTP credential exposure.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
hue.sh:37
Finding

Arbitrary Python Code Execution Through Unvalidated Hexadecimal Color Input

Content
View full analysis
Remediation
View remediation
&2 exit 1 ;; esac ``` 2. Never interpolate external values into Python source code. Pass the color as an argument: ```sh hex_to_hsb() { python3 - "${1#\#}" <<'PY' import colorsys import re import sys hex_color = sys.argv[1] if not re.fullmatch(r"[0-9A-Fa-f]{6}", hex_color): raise SystemExit("Invalid hexadecimal color") r, g, b = ( int(hex_color[i:i + 2], 16) / 255.0 for i in (0, 2, 4) ) h, s, v = colorsys.rgb_to_hsv(r, g, b) print( f'"on":true,"hue":{int(h * 65535)},' f'"sat":{int(s * 254)},"bri":{int(v * 254)}' ) PY } ``` 3. Use a quoted heredoc delimiter such as `<<'PY'` to disable shell expansion within the Python source. 4. Retain validation in both the shell caller and Python implementation as defense in depth. 5. Add negative tests for quotation marks, whitespace, newlines, command syntax, incorrect lengths, and non-hexadecimal characters. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
hue.sh:8
Finding

Arbitrary Shell Command Execution Through Sourced .env Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
hue.sh:29
Finding

Hue API Credential and Control Traffic Transmitted Over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

  • A Philips Hue Bridge on the same local network.
  • curl, jq, and python3 installed on your system.

2. Configure .env file

Create a .env file in the skill directory:

bash
BRIDGE_IP=192.168.1.XX  # Your bridge IP

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
- `SKILL.md`: This documentation.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · hue.sh (reported line 9)May include surrounding context.

sh
SCRIPT_DIR="$(dirname "$0")"
SCRIPT_DIR="$(cd "$SCRIPT_DIR" && pwd)"
CONFIG_FILE="$SCRIPT_DIR/.env"

if [ -f "$CONFIG_FILE" ]; then
  . "$CONFIG_FILE"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documents shell-based capabilities and required binaries but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this creates an authorization gap: the skill may be able to invoke shell commands more broadly than a reviewer or runtime policy expects, increasing the chance of unintended command execution or abuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · hue.sh (reported line 31)May include surrounding context.

sh
url="http://$BRIDGE_IP/api/$USERNAME$path"
  
  if [ "$method" = "GET" ]; then
    curl -s -H "Connection: close" "$url"
  else
    curl -s -H "Connection: close" -X "$method" -d "$data" "$url"
  fi

Static analysis

No suspicious patterns detected.