T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/anova.py:18- Finding
Anova bearer token exposed through WebSocket query string and diagnostic output
- Content
View full analysis
- Remediation
View remediation
Security audit
Anova Oven
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real remote-control tool for Anova cooking appliances, but it lacks adequate guardrails for safely starting, stopping, and validating physical heating actions.
Install only if you are comfortable giving an agent remote control over a real heating appliance. Before use, add or require explicit confirmation for every cook or stop command, verify the selected device, enforce temperature and duration limits, pin dependencies, protect and rotate the Anova token, and locally verify that stop commands actually took effect.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/anova.py:249- Finding
Missing safety bounds permit invalid or hazardous remote heating commands
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/anova.py:95- Finding
Start and stop operations report success without validating appliance acknowledgement
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded WebSocket dependency prevents reproducible and reviewed installations
- Content
View full analysis
=10.0 ``` The installation documentation also recommends an unpinned installation: ```bash pip3 install websockets ``` ### Technical Analysis The dependency declaration sets only a minimum version and has no exact pin, upper bound, lock file, or integrity hash. Installation can therefore resolve to a future release that was not tested or reviewed with this project. This does not demonstrate that the legitimate `websockets` package is malicious. The risk is that builds are not reproducible and may automatically consume a future compromised, incompatible, or behavior-changing release. The dependency executes in the same Python process that handles the Anova token and network connection. ### Attack Path 1. A user installs the Skill dependencies at a later date. 2. The package resolver selects the newest version satisfying `websockets>=10.0`. 3. That version contains an incompatible security regression, compromised release, or unexpected behavior not covered by this audit. 4. The package runs in the Skill's process with access to the Anova token and network communications. 5. The altered dependency could disrupt appliance control or expose sensitive authentication data. ### Impact Assessment A compromised dependency would execute with the privileges of the user running the Skill. It could potentially access files available to that user, including the Anova token, and communicate over the network. An ordinary incompatible update could also break command delivery or acknowledgement behavior. The current source contains no evidence that dependency compromise has already occurred; this finding concerns preventable supply-chain exposure and non-reproducible installation. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 2. **Personal Access Token** - Download the Anova Oven app (iOS/Android) - Navigate to: More → Developer → Personal Access Tokens - Generate a new token (starts with `anova-`) 3. **Python Environment** - Python 3.7 or higher
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill advertises support for remote control of multiple cooking modes and device types that the described implementation may not actually handle correctly. In an appliance-control context, overstated capabilities can cause an agent or user to initiate the wrong cooking behavior, fail to stop the correct device, or assume safety-critical functions exist when they do not.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Prerequisites 1. **Personal Access Token** from Anova app - Download Anova Oven app (iOS/Android) - Go to: More → Developer → Personal Access Tokens - Create token (starts with `anova-`)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Prerequisites 1. **Personal Access Token** from Anova app - Download Anova Oven app (iOS/Android) - Go to: More → Developer → Personal Access Tokens - Create token (starts with `anova-`)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Prerequisites 1. **Personal Access Token** from Anova app - Download Anova Oven app (iOS/Android) - Go to: More → Developer → Personal Access Tokens - Create token (starts with `anova-`)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 73% confidence
- Finding
The documentation instructs storing a long-lived bearer token in a predictable plaintext file path under the home directory. While common, this creates credential exposure risk if local files are over-broadly readable, backed up insecurely, or accessible to other tools on the host; with this token, an attacker could remotely control the user's appliances.
- Content
md 1. **Personal Access Token** from Anova app - Download Anova Oven app (iOS/Android) - Go to: More → Developer → Personal Access Tokens - Create token (starts with `anova-`) - Store in `~/.config/anova/token`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill provides direct commands to start, modify, monitor, and stop a physical cooking appliance, but it includes no safety interlocks such as confirmation prompts for heating actions, warnings about remote activation, or checks that the user explicitly intends to control the device. Because this is a network-connected oven, accidental or ambiguous invocation could cause unattended heating, property damage, or injury, making the omission materially dangerous in context.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
- Store your Anova token:
bash mkdir -p ~/.config/anova echo "anova-YOUR_TOKEN_HERE" > ~/.config/anova/token chmod 600 ~/.config/anova/token
- Store your Anova token:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash mkdir -p ~/.config/anova echo "anova-YOUR_TOKEN_HERE" > ~/.config/anova/token chmod 600 ~/.config/anova/token- Install Python dependencies:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash mkdir -p ~/.config/anova echo "anova-YOUR_TOKEN_HERE" > ~/.config/anova/token chmod 600 ~/.config/anova/token- Install Python dependencies:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README documents commands that can remotely start heating, change cooking modes, and stop appliances, but the warning language is mild and does not clearly state that these actions immediately change the physical state of a network-connected appliance. In the context of an oven/cooker control skill, that omission is safety-relevant because users or downstream agents may treat examples as harmless queries rather than actuator commands, increasing the risk of unintended heating or unattended operation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation enables unattended remote start/stop of a heating appliance without prominently warning about the physical safety risks of activating or changing cooking state remotely. Because this skill controls real-world heating equipment, missing safety guardrails can lead to fire risk, food safety issues, property damage, or harm if operation occurs when the appliance is not being supervised.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill directs users to persist an access token on disk for repeated use, creating durable session material that can survive beyond a single run. In this skill's context, persistent bearer credentials increase the blast radius of local compromise because an exposed token enables ongoing remote control of physical devices.
- Content
md 1. **Personal Access Token** from Anova app - Download Anova Oven app (iOS/Android) - Go to: More → Developer → Personal Access Tokens - Create token (starts with `anova-`) - Store in `~/.config/anova/token` 2. **Python dependencies**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language examples use broad phrases like 'Preheat the oven' and 'Stop cooking' without warning that these prompts may immediately trigger physical appliance actions. In an agent setting, ambiguous natural-language triggers materially increase the chance of accidental or misunderstood execution against a real oven or cooker.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
python # Wait for a state message with element status for _ in range(20): try: message = await asyncio.wait_for(self.ws.recv(), timeout=0.5) data = json.loads(message) self.message_history.append(data)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes starting cooking modes and controlling both Anova Precision Ovens and Precision Cookers, but the actionable control paths here are hard-coded to oven-specific commands like CMD_APO_START/CMD_APO_STOP and oven stage structures. Although device discovery handles both APC and APO events, no cooker-specific start/stop command path is implemented, so the described capability is broader than the actual behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script reads an authentication token from a local config path and uses it for device control, but the code provides no explicit warning that credentials are being accessed. While missing credentials are reported, there is no user-facing disclosure that a sensitive token file will be read for authentication.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script sends real remote-control commands that can start heating or stop an active cook immediately, with no confirmation, dry-run mode, or safety interlock. In the context of an oven/cooker control skill, accidental invocation or misuse can directly affect a physical device, making this more dangerous than a typical non-physical automation action.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified as
websockets>=10.0without an upper bound or exact pin, which makes builds non-reproducible and allows installation of unexpectedly vulnerable or breaking versions over time. In a network-facing skill that controls ovens and cookers over WebSocket, dependency drift can expose the system to avoidable library vulnerabilities or reliability issues in a safety-relevant context.- Content
text websockets>=10.0
Unverifiable Dependency: websockets has 4 known advisory(ies) (CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Because the manifest does not pin the
websocketsversion, it is impossible to verify whether the deployed package includes releases affected by known advisories, including denial-of-service and timing-related issues. This is more concerning here than in a purely offline utility because the skill communicates over WiFi/WebSocket to control physical cooking devices, so network-layer instability or abuse could disrupt operation or availability.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The inline comment says the temperature bulb configuration will 'always use DRY mode', but the function also adds steam generator settings when humidity is supplied, enabling steam-assisted cooking behavior. This creates an intent/documentation mismatch because the comment suggests a narrower non-steam mode than the code actually configures.
- Content
Static analysis
No suspicious patterns detected.