xiaodu-wake-up-routine-official

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill coherently automates a Xiaodu wake-up routine, but it can operate smart-home devices through a separate dependency and store preferences for future runs.

Install only if you already trust the xiaodu-control-official dependency and the configured Xiaodu/mcporter account. On first use, supervise the routine, confirm room/device targeting, and review any saved preferences in XIAODU_CONTEXT.md or MEMORY.md.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Medium
What this means

A single wake-up request may change lights, curtains, scenes, or smart-screen playback in the home.

Why it was flagged

The skill can invoke scripts that trigger scenes, control IoT devices, speak through smart screens, and start assistant/media commands.

Skill content
默认调用链应当是:... `trigger_scene.sh` ... `control_iot.sh` ... `speak.sh` ... `control_xiaodu.sh`
Recommendation

Use it only for a trusted home setup, review the default room/device choices, and require confirmation when the target room or device is unclear.

#
ASI03: Identity and Privilege Abuse
Medium
What this means

Anyone able to invoke the skill may be able to cause actions through the configured Xiaodu smart-home account.

Why it was flagged

The skill depends on already-configured Xiaodu and Xiaodu IoT access, so actions run with the authority of those configured accounts or servers.

Skill content
仅在已确认 `xiaodu-control-official` 已安装,且 `mcporter` 已经配置好 `xiaodu` 与 `xiaodu-iot` 时使用本 skill。
Recommendation

Ensure the underlying mcporter/Xiaodu configuration is trusted and appropriately limited before enabling this skill.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

The safety of actual device control depends on the separate xiaodu-control-official skill.

Why it was flagged

Core control is delegated to another installed skill's scripts, which are not included in this instruction-only package for review.

Skill content
所有底层控制都应优先复用 `skills/xiaodu-control-official`。
Recommendation

Review or trust the dependency before relying on this orchestrator, especially because it controls physical devices.

#
ASI06: Memory and Context Poisoning
Low
What this means

Stored preferences could affect future device choices or routine behavior until edited or removed.

Why it was flagged

The skill intentionally persists user preferences and reuses them in later wake-up routines.

Skill content
小度 / 家庭场景的短中期偏好,优先写入 `XIAODU_CONTEXT.md`。长期稳定偏好,写入 `MEMORY.md`。
Recommendation

Periodically review the saved Xiaodu context and memory entries, especially after changing rooms, devices, or wake-up preferences.