ClawHub
Back to skill

Security audit

Switchbot

Security checks for vulnerabilities and agentic risk

Overview

This SwitchBot skill appears purpose-built for smart-home control, but it exposes broad physical-device commands including locks and raw commands without clear confirmation or scoping safeguards.

Install only if you are comfortable giving the agent durable SwitchBot API access capable of controlling real devices. Review requests carefully, especially for locks, plugs, and batch operations, and prefer adding your own confirmation rule before any unlock or power action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Credential Access

High
Category
Privilege Escalation
Content
#!/usr/bin/env python3
"""
SwitchBot Cloud API Controller
Requires: ~/.config/switchbot/credentials.json with token and secret
"""

import json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
#!/usr/bin/env python3
"""
SwitchBot Cloud API Controller
Requires: ~/.config/switchbot/credentials.json with token and secret
"""

import json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
#!/usr/bin/env python3
"""
SwitchBot Cloud API Controller
Requires: ~/.config/switchbot/credentials.json with token and secret
"""

import json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
#!/usr/bin/env python3
"""
SwitchBot Cloud API Controller
Requires: ~/.config/switchbot/credentials.json with token and secret
"""

import json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documents shell and network-capable operations but does not declare any explicit tool scope or permissions boundaries. In an agent environment, that increases the chance the skill can invoke broader-than-necessary capabilities, including outbound API access and local shell actions, without clear restriction or review.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This skill can unlock locks, power plugs, move curtains, and control lights, but the documentation does not require an explicit confirmation or warn about the physical-world consequences before performing such actions. That can lead to unsafe or unintended actuation, especially for locks and powered devices, if a user request is ambiguous or spoofed.

Session Persistence

Medium
Category
Rogue Agent
Content
### 2. Store Credentials Securely

```bash
mkdir -p ~/.config/switchbot
chmod 700 ~/.config/switchbot

cat > ~/.config/switchbot/credentials.json << 'EOF'
Confidence
73% confidence
Finding
The skill instructs the user to persist long-lived API credentials in a local file under ~/.config, creating durable access to smart-home devices. If the host or account is later compromised, those stored secrets could be reused to control physical devices such as locks, plugs, and curtains.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
mkdir -p ~/.config/switchbot
chmod 700 ~/.config/switchbot

cat > ~/.config/switchbot/credentials.json << 'EOF'
{
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
"secret": "YOUR_SECRET_HERE"
}
EOF
chmod 600 ~/.config/switchbot/credentials.json
```

### 3. Discover Devices
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
from pathlib import Path

CREDENTIALS_PATH = Path.home() / ".config" / "switchbot" / "credentials.json"
API_BASE = "https://api.switch-bot.com/v1.1"

def load_credentials():
    """Load API credentials from config file."""
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
print("2. Copy Token and Secret Key")
        print("\nThen create the credentials file:")
        print(f"  mkdir -p {CREDENTIALS_PATH.parent}")
        print(f"  chmod 700 {CREDENTIALS_PATH.parent}")
        print(f'  echo \'{{"token": "YOUR_TOKEN", "secret": "YOUR_SECRET"}}\' > {CREDENTIALS_PATH}')
        print(f"  chmod 600 {CREDENTIALS_PATH}")
        sys.exit(1)
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
print(f"  mkdir -p {CREDENTIALS_PATH.parent}")
        print(f"  chmod 700 {CREDENTIALS_PATH.parent}")
        print(f'  echo \'{{"token": "YOUR_TOKEN", "secret": "YOUR_SECRET"}}\' > {CREDENTIALS_PATH}')
        print(f"  chmod 600 {CREDENTIALS_PATH}")
        sys.exit(1)
    
    with open(CREDENTIALS_PATH) as f:
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
print(f"  mkdir -p {CREDENTIALS_PATH.parent}")
        print(f"  chmod 700 {CREDENTIALS_PATH.parent}")
        print(f'  echo \'{{"token": "YOUR_TOKEN", "secret": "YOUR_SECRET"}}\' > {CREDENTIALS_PATH}')
        print(f"  chmod 600 {CREDENTIALS_PATH}")
        sys.exit(1)
    
    with open(CREDENTIALS_PATH) as f:
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The `command` CLI path accepts arbitrary device IDs, command names, and parameters, allowing actions beyond the narrowly described curtain/plug operations in the skill metadata. In an agent setting, this broadens the capability surface and can enable unexpected control of locks, IR remotes, or other SwitchBot devices if higher-level policy assumes only limited device-specific actions are available.

Static analysis

No suspicious patterns detected.