T08 · Insecure Dependencies
Error
- Location
scripts/configure_mcporter.sh:121- Finding
Unpinned npm Package Execution with Access to the Xiaodu Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
小度控制
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its Xiaodu smart-device control purpose, but it stores a device-control token and uses under-scoped mechanisms that could expose credentials or affect real devices without enough safeguards.
Review before installing. Use only with a trusted Xiaodu account and device environment, avoid --base-url unless you are certain of the endpoint, prefer a pinned or locally vetted dueros-iot-mcp package, protect ~/.mcporter/mcporter.json as a secret store, and require explicit confirmation before camera capture, media playback, door-lock, scene, or broad household control actions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/configure_mcporter.sh:46- Finding
Access Token Can Be Sent to an Arbitrary User-Supplied Endpoint
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/refresh_devices.sh:50- Finding
Persistent Device Inventory Files Are Created Without Explicit Confidentiality Permissions
- Content
View full analysis
"$SPEAKER_JSON" ``` The same script subsequently writes the IoT inventory and generated summary into the same directory: ```bash if [[ -n "$IOT_SERVER" ]]; then echo "[xiaodu-control] 正在从 '$IOT_SERVER' 拉取 IoT 设备" if ! mcporter call "${IOT_SERVER}.GET_ALL_DEVICES_WITH_STATUS" --output json >"$IOT_JSON"; then echo "[xiaodu-control] 警告: 从 '$IOT_SERVER' 拉取 IoT 设备失败" >&2 rm -f "$IOT_JSON" fi fi ``` ### Technical Analysis The script persists smart-display and IoT inventory data in plaintext. The generated content can include device names, room information, online status, CUID values, Client IDs, appliance names, and current device state. Neither a restrictive `umask` nor explicit directory and file modes are established. As a result, permissions depend on the invoking process's ambient umask and on any pre-existing output directory or files. In a multi-user environment or a workspace shared with other processes, the resulting inventory may be readable by principals that do not need access. The output directory is also configurable through `--out-dir` and `XIAODU_WORKSPACE_DIR`, increasing the chance that sensitive snapshots may be written into a shared, synchronized, backed-up, or otherwise broadly accessible location. ### Attack Path 1. A user runs `scripts/refresh_devices.sh` in an environment with a permissive umask or selects a shared output directory. 2. The script creates or truncates plaintext JSON and Markdown inventory files without enfo ...[truncated 813 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (49)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 只从文本里提取 `xiaodu-...` token，并执行 `bash scripts/configure_mcporter.sh --text "..."`。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 只从文本里提取 `xiaodu-...` token，并执行 `bash scripts/configure_mcporter.sh --text "..."`。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 只从文本里提取 `xiaodu-...` token，并执行 `bash scripts/configure_mcporter.sh --text "..."`。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 只从文本里提取 `xiaodu-...` token，并执行 `bash scripts/configure_mcporter.sh --text "..."`。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 不要打开或遵循授权文本里的远程 `SKILL.md`。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to run shell commands and write configuration via mcporter, including handling access tokens and modifying user-scoped config, but it declares no tool scope or permission boundary. That mismatch is dangerous because a host may permit broader-than-expected shell/file access, making unintended command execution or configuration changes easier if the skill is invoked on adversarial or malformed input.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The display name, description, and default prompt all require Chinese comprehension, but the file does not state that the skill is China-specific or that Chinese is an intentional, opt-in locale constraint. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document explicitly advertises a photo capture capability but does not require an explicit privacy warning, consent check, or confirmation step before image capture. In a smart-screen/home IoT context, silent or surprise photo capture can collect sensitive household images, bystanders, or location clues, making this more dangerous than a generic camera reference.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document promotes pushing images, video, or audio to a device without warning that user-provided content will be transmitted and displayed/played on a physical endpoint. In a household smart-device setting, this can expose private media to nearby viewers/listeners, create unwanted broadcasts, or leak sensitive content to the wrong device if targeting is unclear.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill documentation is written as if Chinese is the required interaction language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only locale. The policy requires flagging language or locale constraints when they are imposed without opt-in or clear justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation includes a photo-capture command for a smart display camera without any privacy warning, consent requirement, or guidance to verify user authorization. In a home-device control skill, normalizing camera activation as a routine command increases the risk of covert image capture or accidental surveillance in private spaces.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The IoT control and scene-trigger examples show direct operation of household devices and scenes without warning that these actions can change the physical environment, unlock behavior patterns, or create safety issues. In this skill's context, commands can affect lighting, HVAC, curtains, and other home systems, so omission of safety checks and confirmation steps materially increases misuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide instructs users to paste the full authorization text containing an AccessToken into the agent workflow, but it never clearly labels the token as a sensitive credential or warns against sharing, logging, or exposing it. In a skill that automates device control, that token likely grants access to smart screen and IoT operations, so mishandling could let another party control devices or query associated resources.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation tells users that the AccessToken will be written to ~/.mcporter/mcporter.json but does not warn that this creates persistent local secret storage that may be readable by other local users, backup systems, or support tooling depending on file permissions and environment setup. Because this skill controls Xiaodu and IoT devices, compromise of the stored token could enable unauthorized device operations and ongoing access until the token is rotated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file uses Chinese-only placeholder text and service naming conventions, which may impose a language/locale expectation without documenting user choice or opt-in. Under the language policy check, this is a natural-language locale constraint that is not justified in the file itself.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file title and opening instruction direct the skill to prioritize Chinese templates whenever the skill is used in any chat channel. This imposes a language preference by default without offering the user a language choice or documenting a justified locale-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
These templates encourage camera capture, media pushing, speech output, and direct IoT control without embedding explicit consent, privacy, or safety checks. In a skill that can affect physical devices and collect imagery, ready-made prompts can normalize sensitive actions and increase the chance the agent performs them without verifying authorization or warning the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The photo test cases instruct operators to trigger a device camera and save outputs locally, but they do not warn about consent, bystander privacy, or sensitive image handling. In a smart-screen/IoT control skill, that omission increases the chance of unauthorized image capture or careless retention of private data during routine testing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The resource-push and IoT control tests direct the operator to display media, play audio/video, and change device states without a clear warning that these actions can affect real physical devices and environments. In this skill context, missing cautions can lead to unintended disruption, nuisance, or unsafe state changes on household equipment during testing.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The guide tells users to execute
npx -y dueros-iot-mcpwithout pinning a specific package version. That allows whatever version is current in the registry at execution time to run arbitrary install/startup code on the user's machine, creating a supply-chain risk if the package is compromised or a breaking/malicious release is published. In this skill context, the risk is heightened because the command is presented as a standard troubleshooting step for local execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This repeats the recommendation to run
npx -y dueros-iot-mcpwithout a pinned version, again exposing users to execution of unreviewed future registry content. Becausenpxmay download and immediately execute package code, an attacker controlling the package or a compromised upstream release could gain code execution on the local system. The troubleshooting context makes this operationally likely, since users are instructed to run it manually as a recovery step.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script claims it only configures the XiaoDu MCP endpoints, but it accepts an arbitrary
--base-urland then stores that URL in mcporter with the user's access token attached as a header. In a skill whose purpose is configuring and controlling smart-home services, this broadens scope in a security-relevant way: a caller can redirect credentialed traffic to an attacker-controlled endpoint and capture the token or manipulate responses.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script writes the access token into mcporter configuration via header/env settings without warning the user that the credential will be persisted locally. In this skill context, the token enables access to device-control capabilities, so silent persistence increases the chance of credential exposure through local config files, backups, logs, or multi-user workstation access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script directly executes an IoT control action through
mcporter callusing user-supplied device, action, and optional attribute/value parameters, without any confirmation, authorization check, or safety interlock. In the context of a skill explicitly designed to control physical devices such as locks, curtains, TVs, and appliances, this increases the risk of unintended or abusive real-world actions if the tool is triggered by mistake, social engineering, or a compromised upstream agent.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
All user-facing usage and error messaging in the script is written in Chinese, and the file does not offer any language selection or explain that the skill is intentionally limited to a Chinese-speaking locale. This creates a natural-language locale policy concern because the skill imposes a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.