Wiz Smart Light Control

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:37 PM UTC
• Version: 1.0.1

Overview

This skill transparently controls local Wiz smart bulbs, with no hidden data access or persistence, but users should review the unpinned dependency and physical-device control prompts.

Install only if you are comfortable letting the agent change Wiz bulb state on your local network. Use explicit prompts naming this skill and the target bulb, and consider pinning pywizlight to a reviewed version before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Automatic Installation of an Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1 (installation instruction at SKILL.md:20-25)
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

pywizlight

The dependency is installed automatically as directed by SKILL.md:20-25:

bash

# 1. Create Virtual Environment and Install Dependencies
python3 -m venv venv && source venv/bin/activate && pip install -r requirements.txt

Technical Analysis

The requirements file specifies pywizlight without an exact version or cryptographic hash. The skill instructions tell the agent to run the installation automatically when the virtual environment does not exist. Consequently, the package installer resolves and downloads whichever compatible release is available at installation time.

This makes installations non-reproducible and leaves the skill exposed to upstream package compromise, malicious release replacement, or unexpected security and behavior changes in future versions. Python packages may execute build-backend or installation-related code, and imported dependency code executes with the privileges of the user running the skill.

No evidence indicates that the currently named package is malicious. The confirmed issue is the absence of dependency pinning and integrity verification combined with automatic installation.

Attack Path

1. An attacker compromises the upstream dependency, a maintainer account, or the applicable package distribution channel.
2. The attacker publishes or substitutes a malicious release under the expected package name.
3. The agent follows the mandatory setup instruction and executes pip install -r requirements.txt.
4. Because no version or hash is specified, pip accepts the attacker-controlled release if selected by dependency resolution.
5. Malicious package code executes during installation, import, or su ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pywizlight to an exact, reviewed version rather than allowing unconstrained resolution.
2. Generate a lock file containing cryptographic hashes for all direct and transitive dependencies.
3. Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
4. Review dependency release notes and security advisories before updating the pinned version.
5. Obtain explicit user approval before installing packages instead of directing the agent to install them automatically.
6. Use a trusted package index and, where practical, an internally controlled mirror containing approved artifacts.
7. Run installation and the skill in an isolated, least-privileged environment with restricted filesystem and network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example prompts are generic household phrases like 'Turn off the light' and 'Change the light color to red,' which are likely to overlap with normal conversation or unrelated user intent. Because this skill controls physical devices on the local network, broad trigger phrases increase the chance of unintended activation and unauthorized or surprising physical actions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified without a version pin, so installs may pull in different upstream releases over time. That creates supply-chain and reliability risk: a future compromised or breaking release of pywizlight could be introduced into the skill without review, even though this file itself contains no overtly malicious content.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pywizlight

Static analysis

No suspicious patterns detected.