Security audit

Sensor

Security checks for vulnerabilities and agentic risk

Overview

The skill is local-only, but it advertises sensor operations that the script largely does not perform and instead routes user input into persistent logs.

Review this before installing if you need real IoT operations. Treat it as a local sensor note logger, not a device polling, connectivity, conversion, or telemetry analysis tool. Avoid entering secrets, credentials, private hostnames, or sensitive incident details unless durable files under ~/.local/share/sensor are acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims active sensor operations such as polling devices, checking connectivity, converting units, and analyzing telemetry, but the described behavior is primarily local logging and exporting arbitrary user-provided text. This mismatch can mislead users and higher-level agents into trusting the skill with operational tasks it does not perform, while silently persisting potentially sensitive operational data to disk in per-command logs and exports.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill’s stated purpose is IoT sensor management, but the exposed commands and help text advertise capabilities that are not actually implemented. This kind of functionality mismatch is dangerous because users may trust the tool with operational or sensitive device-related input, while it instead acts as a local data collector and logger, creating risk of unintended data capture and deceptive behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Most command handlers merely append arbitrary user input to log files and echo it back, despite being named as operational sensor functions such as run, check, convert, and analyze. In a security review, this is a true issue because the behavior is materially deceptive and can lead operators to disclose device names, endpoints, credentials, telemetry, or internal notes under the false impression that real processing is occurring.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Commands such as generate, preview, batch, report, config, and recent/history tracking introduce a broad general-purpose logging toolkit surface rather than a focused IoT sensor utility. These capabilities are not clearly tied to polling readings, checking connectivity, unit conversion, or telemetry trend analysis as described in the manifest.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The help text presents status as a health-check feature, but the first status branch logs arbitrary user input instead of calling the implemented status routine. This mismatch can cause users to submit operational details expecting diagnostic output, while the tool silently retains that information in log files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The help text documents an export formatter, but the main dispatcher’s first export branch captures the command and logs arbitrary input instead, making the real export routine effectively unreachable. This is dangerous because it misleads users about where their data goes and causes input intended as a format selector or export action to be persistently stored instead.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The export feature aggregates historical log content and writes it to disk in bulk formats without a privacy warning or safeguards. This increases exposure by concentrating potentially sensitive user-entered data into a single easily copied file, raising the risk of unintended disclosure on shared or monitored systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-supplied input is persistently written to local logs without clear disclosure, consent, retention policy, or sensitivity controls. In the context of a purported sensor-management utility, users may reasonably enter hostnames, device identifiers, readings, incident notes, or even secrets, making silent retention a meaningful privacy and security issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.