Aqara OpenAPI Local

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.0.3

Overview

This Aqara smart-home skill is purpose-aligned and disclosed, though users should treat it as real device and automation control software.

Install only if you trust the publisher and are comfortable giving the skill your Aqara API token. Before running deletes, broad room moves, or device-control automations, verify the exact IDs/names and require explicit confirmation. Double-check button/event enum values against live capabilities before creating automations from examples.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This example is internally inconsistent: it says the automation triggers on a double press, but the JSON uses event value "0", which the note later identifies as single press. In an automation skill, misleading trigger semantics can cause users to deploy automations that fire under the wrong physical interaction, creating unintended device actions and unsafe behavior in the home.

VirusTotal

66/66 vendors flagged this skill as clean.