Security audit

Roborock Vacuum Control

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for controlling a Roborock vacuum, but it needs review because it combines device control, account login, map access, and an unpinned third-party CLI without enough safeguards.

Install only if you trust the python-roborock package and are comfortable giving a CLI access to your Roborock/Xiaomi account and home-layout data. Authenticate through the CLI prompt rather than pasting secrets into chat, treat device IDs and exported maps as private, and confirm before allowing commands that start, stop, dock, clean rooms, reset consumables, or change settings.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
" ``` 2. Prefer installation from a locked, trusted artifact with a verified cryptographic hash. If `pipx` cannot enforce the required hash workflow directly, download and verify the wheel in a controlled process before installing it. 3. Establish a dependency-review process that checks the package publisher, release history, source repository, transitive dependencies, and artifact integrity before updating the pinned version. 4. Clearly disclose that the CLI is a third-party client and that it will handle sensitive Roborock or Xiaomi authentication material. 5. Recommend using a dedicated, least-privilege smart-home account where the service supports one, and avoid reusing its password elsewhere. 6. Store authentication tokens only in operating-system-protected credential storage with restrictive file permissions. Do not place passwords, tokens, or other secrets in `TOOLS.md` or other plaintext project files. 7. Execute the CLI under a non-administrative operating-system account and restrict its access to unrelated files, credentials, and network destinations where practical. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is broad enough to match common requests like 'clean floor' or 'hoover', which can cause this skill to activate in situations where the user did not specifically intend to control a physical device. Because the skill can issue real-world commands to start, stop, or dock a vacuum, overbroad routing increases the chance of unintended actuation and privacy-affecting actions such as map access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs the user to log in with Roborock/Xiaomi credentials and later includes map export and device-management capabilities, but it does not warn about the sensitivity of credentials, device identifiers, or home layout data. In a skill context that may be followed by an agent, this omission can lead to unsafe handling of secrets and privacy-sensitive outputs, including exposing account credentials or floor maps in logs, transcripts, or shared files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.