Xiaomi Home Control

• Outcome: Review
• Latest audit: May 29, 2026 · 9:35 PM UTC
• Version: 1.2.2

Overview

The skill matches its smart-home purpose, but it gives broad AI-driven control over locks and other physical devices while under-disclosing credential, network, and persistence risks.

Review before installing. Use a dedicated least-privilege Home Assistant token if possible, protect or rotate the token, bind the MCP server strictly to localhost, avoid autonomous unlock or whole-home commands without explicit confirmation, and verify any LaunchAgent or Docker service persistence before enabling it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The code intends to restrict browser access to localhost, but `origin.startsWith("http://localhost")` also accepts attacker-controlled origins such as `http://localhost.evil.com`. If this server is reachable by a browser and the bearer token is exposed to that origin or a local web page, the CORS check can be bypassed and sensitive home automation actions can be invoked.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The script header claims it only installs Home Assistant and configures the MCP server, but later it also installs and loads a persistent macOS LaunchAgent. That mismatch reduces informed consent and can mislead users about persistence behavior, which is a legitimate security concern even if the behavior is not overtly malicious.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly advertises remote door lock control without any warning, confirmation requirement, or discussion of risks such as accidental unlocks, unsafe automation, or abuse through prompt mistakes. In a home-control skill, lock operations are safety- and security-sensitive, so documenting them as ordinary commands increases the chance of dangerous use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The usage section includes high-impact commands like "Lock all doors," "Turn off all lights," and opening blinds, but provides no caution about unintended whole-home effects or need for confirmation. Natural-language home automation is prone to ambiguity and misfires, so bulk and security-relevant actions without safeguards can lead to safety, privacy, or physical security issues.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Describing the skill as handling 'plain text or voice commands' without clear scoping implies that nearly any natural-language home-control request may activate it. That ambiguity increases the chance of unintended execution of physical-world actions, including door lock operations and device state changes, if the platform routes commands too permissively.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Describing the skill as handling 'plain text or voice commands' without clear scoping implies that nearly any natural-language home-control request may activate it. That ambiguity increases the chance of unintended execution of physical-world actions, including door lock operations and device state changes, if the platform routes commands too permissively.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill prominently markets door lock control ('lock/unlock from anywhere') and includes example commands for lock operations, but it does not warn users that these are security-sensitive actions requiring extra caution. Without such warning, users may enable remote physical-access control through casual natural-language interactions, increasing the risk of accidental lock changes or unsafe automation behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The webhook example explicitly uses plain HTTP to send automation messages, which can expose message contents to interception or modification if the traffic leaves the local host boundary or is later adapted to a remote endpoint. In a home automation context, alert messages may reveal occupancy, device states, or security events, creating privacy and operational risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs users to place a long-lived Home Assistant token directly into persistent configuration, but does not warn that this token is a sensitive secret with broad API access. If the config file is exposed through backups, screenshots, shell history, source control, or local compromise, an attacker could use the token to control Home Assistant devices and access automation data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The .env instructions tell users to paste a copied long-lived access token into a file without any caution about secret exposure. In this skill context, the token grants access to a home automation system, so leakage could allow unauthorized device control, monitoring, or abuse of connected home functions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends an Authorization bearer token over plain HTTP using Node's http module. If HOST is changed from localhost or traffic is exposed through containers, VM networking, or port forwarding, the token can be intercepted in transit and reused to access Home Assistant. In this skill context, the credential is a high-value home automation secret, which makes unauthenticated transport more dangerous than a generic local request.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script prompts for a Home Assistant long-lived access token and stores it directly in a local .env file without warning, masking, or permission hardening. This can expose a powerful credential to other local users, backups, shell history-adjacent workflows, or accidental inclusion in source control, enabling unauthorized control of the user's Home Assistant instance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script starts a Docker container with `--privileged`, persistent volume mounts, network exposure, and automatic restart, but does not clearly warn the user about these high-impact system changes. While this may be intended for convenience, running a privileged container materially increases host risk if the container image or service is compromised.

Credential Access

High

• Category: Privilege Escalation

Content

echo "=========================================="
    echo "Enter your Home Assistant Long-Lived Access Token:"
    read -r HA_TOKEN
    echo "HA_URL=http://localhost:8123" > "$SCRIPT_DIR/.env"
    echo "HA_TOKEN=$HA_TOKEN" >> "$SCRIPT_DIR/.env"
    echo "PORT=3002" >> "$SCRIPT_DIR/.env"
    echo "✓ Created .env file"

• Confidence: 98% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

echo "=========================================="
    echo "MCP Server Configuration"
    echo "=========================================="
    echo "Enter your Home Assistant Long-Lived Access Token:"
    read -r HA_TOKEN
    echo "HA_URL=http://localhost:8123" > "$SCRIPT_DIR/.env"
    echo "HA_TOKEN=$HA_TOKEN" >> "$SCRIPT_DIR/.env"

• Confidence: 90% confidence
• Finding: Access Token

Session Persistence

Medium

• Category: Rogue Agent

Content

echo ""
echo "Installing HA MCP Server as LaunchAgent..."
mkdir -p "$HOME/Library/LaunchAgents"
mkdir -p "$(dirname "$PLIST_SRC")"

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"

• Confidence: 94% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$HOME/Library/LaunchAgents"
mkdir -p "$(dirname "$PLIST_SRC")"

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"
sed "s|/Users/nanali|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || true

• Confidence: 95% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$(dirname "$PLIST_SRC")"

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"
sed "s|/Users/nanali|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || true
echo "✓ HA MCP Server installed as LaunchAgent"

• Confidence: 96% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$(dirname "$PLIST_SRC")"

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"
sed "s|/Users/nanali|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || true
echo "✓ HA MCP Server installed as LaunchAgent"

• Confidence: 96% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"
sed "s|/Users/nanali|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || true
echo "✓ HA MCP Server installed as LaunchAgent"

• Confidence: 98% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"
sed "s|/Users/nanali|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || true
echo "✓ HA MCP Server installed as LaunchAgent"

• Confidence: 98% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"
sed "s|/Users/nanali|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || true
echo "✓ HA MCP Server installed as LaunchAgent"

echo ""

• Confidence: 97% confidence
• Finding: launchctl load

Session Persistence

Medium

• Category: Rogue Agent

Content

# Create user-specific plist
PLIST_DST="$HOME/Library/LaunchAgents/ai.openclaw.ha-mcp.plist"
sed "s|/Users/nanali|$HOME|g" "$PLIST_SRC" > "$PLIST_DST"
launchctl load "$PLIST_DST" 2>/dev/null || true
echo "✓ HA MCP Server installed as LaunchAgent"

echo ""

• Confidence: 97% confidence
• Finding: PLIST

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/ha-mcp-server/src/call-tool.mjs:22