ClawHub
Back to skill

Security audit

enzoldhazam

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do thermostat control as advertised, but its installation asks users to build mutable external code and place it in a system-wide path while the reviewed artifact does not include the full installable program.

Review before installing. Prefer a pinned, reviewed release with checksum or signature verification, install into a user-owned bin directory instead of using sudo, and use Keychain login rather than long-lived shell environment variables. Only allow the agent to change temperatures after explicit confirmation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:14
Finding

Unpinned Remote Source Is Built and Installed into a Privileged System Path

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
internal/api/client.go:161
Finding

Thermostat Setpoints Are Submitted Without Local Finite-Value or Range Validation

Content
View full analysis
Remediation
View remediation
thermostat.TMax { return nil, fmt.Errorf( "temperature %.1f is outside the allowed range %.1f–%.1f", temperature, thermostat.TMin, thermostat.TMax, ) } ``` 3. Add a conservative application-level absolute range as defense in depth when device metadata is missing or untrusted. 4. Validate the serial number and thermostat ID against devices returned for the authenticated account before mutation. 5. Preserve the explicit user-confirmation requirement in `SKILL.md` before changing a physical thermostat. 6. Check and propagate errors from every `WriteField` call and from `writer.Close()`. 7. Add unit tests covering boundary values, values immediately outside the range, NaN, positive and negative infinity, and missing thermostat metadata. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as thermostat control, but it also handles credential storage, retrieval from environment variables, and credential clearing. That mismatch increases the chance that users or orchestrators authorize the skill for innocuous home-control tasks without realizing it can access or manipulate authentication material.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill explicitly stores credentials in the OS keychain and supports reading authentication secrets from environment variables. While this may be functional rather than malicious, credential handling is sensitive in an agent context because the skill can become a pathway to access, persist, or misuse secrets beyond simple thermostat control.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
| `enzoldhazam status --json` | JSON output for parsing |
| `enzoldhazam get <room>` | Get specific room details |
| `enzoldhazam set <room> <temp>` | Set target temperature |
| `enzoldhazam login` | Save credentials to Keychain |
| `enzoldhazam logout` | Clear stored credentials |

## Examples

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 6)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 25)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 28)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 32)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 55)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 60)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 65)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 77)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 78)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 79)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 91)May include surrounding context.

go
import (
	"os"

	"github.com/zalando/go-keyring"
)

const (

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 23)May include surrounding context.

go
Serial   string
}

// Save stores credentials in the macOS Keychain
func Save(creds Credentials) error {
	if err := keyring.Set(serviceName, userKey, creds.Username); err != nil {
		return err

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 39)May include surrounding context.

go
Serial   string
}

// Save stores credentials in the macOS Keychain
func Save(creds Credentials) error {
	if err := keyring.Set(serviceName, userKey, creds.Username); err != nil {
		return err

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 74)May include surrounding context.

go
Serial   string
}

// Save stores credentials in the macOS Keychain
func Save(creds Credentials) error {
	if err := keyring.Set(serviceName, userKey, creds.Username); err != nil {
		return err

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 54)May include surrounding context.

go
}, nil
	}

	// Fall back to keychain
	username, err := keyring.Get(serviceName, userKey)
	if err != nil {
		return nil, err

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 90)May include surrounding context.

go
}, nil
	}

	// Fall back to keychain
	username, err := keyring.Get(serviceName, userKey)
	if err != nil {
		return nil, err

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to place their account username and password in environment variables, but does not warn that environment variables can be exposed through shell history, process inspection, crash reports, logs, or inherited subprocess environments. For a tool that controls smart-home thermostats and accesses a real account, this creates a realistic credential disclosure risk rather than a purely theoretical documentation issue.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill invokes environment-based credentials and operational CLI commands but does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can allow the skill to be selected or executed without clear user/admin review of its access to secrets and local execution capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger language is broad enough to match ordinary conversation about temperature or heating, which can cause over-invocation of a state-changing skill. In context, this is more dangerous because the skill can control real smart-home devices, so an accidental match could lead to unintended thermostat changes or related credential prompts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The setup instructions require sudo mv into /usr/local/bin, normalizing privileged execution during installation. Encouraging root-level file operations for an unverified downloaded binary increases the blast radius if the repository or build process is compromised.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

git clone https://github.com/daniel-laszlo/enzoldhazam.git cd enzoldhazam go build -o enzoldhazam ./cmd/enzoldhazam sudo mv enzoldhazam /usr/local/bin/

text

2. Login (credentials stored in macOS Keychain):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This function collects a username and password and sends them in an HTTP POST request to a remote service, but the code provides no user-facing confirmation, logging, or warning that credentials will be transmitted. The surrounding comments describe the implementation steps, but they are developer-oriented rather than disclosure to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This method performs a remote POST request that changes thermostat settings, which is a state-changing operation affecting the user's environment. Although the function name and comments describe its purpose, there is no visible confirmation prompt or user-facing disclosure in this file before the action is sent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code reads username, password, and serial values from environment variables, which is a sensitive credential-access operation. While comments describe the control flow, there is no user-facing warning, logging, confirmation, or broader disclosure that credentials may be sourced from process environment variables.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.