Security audit

xiaodu-wake-up-routine-official

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent Xiaodu wake-up routine, but it grants real smart-home control and persistent household preference storage while its defaults for media, weather, reminders, and music are internally inconsistent.

Review before installing. Use this only with a trusted xiaodu-control-official dependency and a trusted Xiaodu/mcporter account. Before first use, set clear preferences for whether weather, time, reminders, music, and persistent memory are allowed by default, and supervise device targeting so it does not act on the wrong room or smart screen.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill is presented as a narrow scene-orchestration wrapper, but later expands its default behavior to include additional media and information actions such as weather, time, reminders, and music. That mismatch can cause operators or downstream agents to invoke it expecting limited wake-up automation while it performs broader, potentially privacy-impacting or disruptive actions by default.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document says assistant/media actions should only be added when the user explicitly requests them, but later mandates them as part of the default wake-up flow. This internal contradiction increases the chance an agent will over-execute actions the user did not intend, especially in a household environment where unsolicited speech, news, or music can disturb occupants or disclose information.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The test cases expand the skill from a stated scene-first wake-up orchestrator into a broader automation chain that triggers time, weather, reminders, and music. This scope creep can cause the agent to perform actions or access capabilities not clearly covered by the original skill contract, increasing the chance of unintended device actions, over-collection of contextual data, and misleading claims about what the skill is authorized to do.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The test case authorizes adjustment of air conditioners or fans based on subjective phrases like 'too stuffy' or 'too hot,' which goes beyond the declared wake-up routine behavior. In a child-focused bedroom context, broadening environmental control without an explicit, bounded contract can lead to unexpected actuation of home devices and unsafe assumptions about comfort or safety conditions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation wording includes broad phrases like entering a wake-up state or starting a morning mode, which can overlap with ordinary conversation and be interpreted too aggressively by an agent. In a home-control context, ambiguous triggers materially increase the risk of unintended device control, playback, and spoken announcements.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The listed strong triggers are generic, high-level phrases without sufficient scope constraints, making accidental activation more likely. Because the skill can control IoT devices and initiate smart-screen speech/media, ambiguous triggering has real-world effects beyond a harmless text response.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs persistent storage of household preferences into context or memory files without clearly requiring user notice and consent at the time of writing. In this context, stored preferences may reveal family routines, device ownership, room associations, and child-related habits, creating privacy and profiling risk if retained unexpectedly.

Static analysis

No suspicious patterns detected.