Duwi Smart Home

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 1.0.6

Overview

The skill matches its smart-home purpose, but it can directly control physical devices and documents unsafe credential entry patterns without enough user-control safeguards.

Install only if you trust the Duwi account and machine context. Prefer interactive hidden credential entry, avoid putting secrets or passwords in commands, confirm every device or scene action with the user before running it, and treat the local config, token, and cache files as sensitive household data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_config.py:164

Finding

Secrets Exposed Through Command-Line Arguments

Content

View full analysis

/cmdline` on applicable systems. - Process-monitoring and endpoint telemetry. - Terminal transcripts and Agent execution logs. - Wrapper scripts, orchestration logs, or command auditing facilities. Interactive fallback using `getpass.getpass()` is available and avoids terminal echo, but the vulnerable command-line path remains explicitly ...[truncated 1674 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/cache.py:76

Finding

Sensitive Household Metadata Cached Without Restrictive Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是智能家居业务能力和对 Duwi 开放平台 API 的使用，但给出的代码片段仅是通用缓存基础设施模块，与智能家居控制逻辑没有直接对应关系。该代码访问本地文件系统，在 .cache 目录下持久化 JSON 缓存，并提供 TTL 过期、清理和统计功能；而声明中的核心能力（设备控制、场景执行、状态查询）以及任何外部平台 API 交互都未出现。虽然缓存可以作为实现此类技能的支持性组件，但当前代码片段本身的主要目的与声明的主要功能明显不一致，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

声明描述的是面向终端功能的智能家居控制能力（设备控制、场景执行、状态查询），而该代码片段并未实现这些能力。其主要作用是初始化和管理开放平台应用凭证，包括输入、格式校验、远程验证以及本地持久化保存。虽然这可能是整个技能的配套初始化步骤，但就该代码片段本身而言，实际行为与声明的主要功能存在明显偏差，且包含未在描述中体现的敏感配置处理能力。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill appears to require shell, network, file read, and file write capabilities, yet the manifest does not declare any explicit tool scope or permissions boundaries. In an agent setting, this weakens least-privilege controls and makes it harder for a host to constrain credential handling, local file persistence, and command execution safely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation provides direct commands for controlling breakers, lights, curtains, HVAC, floor heating, and scenes without requiring a confirmation step for state-changing actions in the physical environment. In a smart-home context, accidental or manipulated execution could affect safety, privacy, energy usage, or physical security, especially for power, locks/lock-modes, HVAC, and scene automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code serializes arbitrary cache values to JSON files under a shared .cache directory, which can persist user or tool data on disk beyond a single process. Although the function docstring describes caching behavior, there is no user-facing disclosure, confirmation, or warning that data supplied to this API will be stored on the filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code file issues real device commands through client.device_command, which can change the state of lights, curtains, HVAC, and other home systems. Although success is logged after execution, there is no pre-action confirmation, cautionary disclosure, or warning in the code about the real-world impact of these operations.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 148)May include surrounding context.

python

endpoint: str,
        params: Optional[Dict] = None,
        json_data: Optional[Dict] = None,
        skip_auth_refresh: bool = False,
    ) -> Dict[str, Any]:
        """
        发送 HTTP 请求

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 158)May include surrounding context.

python

endpoint: str,
        params: Optional[Dict] = None,
        json_data: Optional[Dict] = None,
        skip_auth_refresh: bool = False,
    ) -> Dict[str, Any]:
        """
        发送 HTTP 请求

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 188)May include surrounding context.

python

endpoint: str,
        params: Optional[Dict] = None,
        json_data: Optional[Dict] = None,
        skip_auth_refresh: bool = False,
    ) -> Dict[str, Any]:
        """
        发送 HTTP 请求

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 204)May include surrounding context.

python

endpoint: str,
        params: Optional[Dict] = None,
        json_data: Optional[Dict] = None,
        skip_auth_refresh: bool = False,
    ) -> Dict[str, Any]:
        """
        发送 HTTP 请求

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 220)May include surrounding context.

python

endpoint: str,
        params: Optional[Dict] = None,
        json_data: Optional[Dict] = None,
        skip_auth_refresh: bool = False,
    ) -> Dict[str, Any]:
        """
        发送 HTTP 请求

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 230)May include surrounding context.

python

endpoint: str,
        params: Optional[Dict] = None,
        json_data: Optional[Dict] = None,
        skip_auth_refresh: bool = False,
    ) -> Dict[str, Any]:
        """
        发送 HTTP 请求

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 171)May include surrounding context.

python

if method == "GET":
                response = requests.get(url, headers=headers, params=params, timeout=10)
            elif method == "POST":
                response = requests.post(
                    url, headers=headers, json=json_data, timeout=10
                )
            elif method == "PUT":

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 243)May include surrounding context.

python

if method == "GET":
                response = requests.get(url, headers=headers, params=params, timeout=10)
            elif method == "POST":
                response = requests.post(
                    url, headers=headers, json=json_data, timeout=10
                )
            elif method == "PUT":

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 175)May include surrounding context.

python

url, headers=headers, json=json_data, timeout=10
                )
            elif method == "PUT":
                response = requests.put(
                    url, headers=headers, json=json_data, timeout=10
                )
            elif method == "DELETE":

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/duwi_client.py (reported line 247)May include surrounding context.

python

url, headers=headers, json=json_data, timeout=10
                )
            elif method == "PUT":
                response = requests.put(
                    url, headers=headers, json=json_data, timeout=10
                )
            elif method == "DELETE":

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a smart-home skill for device control, scene execution, and status queries. This client also performs full account authentication workflows and persists access/refresh tokens to a local file, which is a broader account-management capability not mentioned in the stated description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code exposes methods that send live control commands to devices, groups, and scenes via HTTP requests, which can change the user's physical environment. Although the methods have technical docstrings, there is no user-facing confirmation, warning, or visible disclosure that these operations will actuate smart-home devices immediately.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The verify_credentials method overwrites self.access_token with the literal value "credentials_test" and never restores the previous token. A caller expecting a non-mutating validation check can unintentionally corrupt authenticated state, causing later requests to fail or behave unpredictably; in a smart-home skill, this can disrupt device operations and recovery flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file's natural-language interface, instructions, prompts, and help text are written in Chinese, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified; neither appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script explicitly supports passing the SECRET via command-line arguments (--secret <SECRET>), which can expose sensitive credentials through shell history, process listings, audit logs, and orchestration tooling. In the context of a smart-home skill, leaked app credentials could enable unauthorized API access to device control, state queries, or account-linked operations, making this more dangerous than an ordinary local-secret disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The markdown advertises cache clean and cache clear as maintenance commands, but does not explain whether clearing cache may remove locally stored context that affects future behavior. Because this can alter user workflow or cause loss of convenience state, a brief warning would improve safety and predictability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring and inline documentation are written entirely in Chinese, which imposes a specific language without any visible opt-in or justification in this file. Under the language/locale policy, forcing a single language can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The delete and clear functions remove cache files from disk, and clear() can remove all JSON cache entries in the cache directory. While these operations are part of cache management, the file contains no visible confirmation prompt, log message, or user-facing notice that cached files may be deleted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Docstrings and all user-facing print messages in this file are written in Chinese, which imposes a specific language on users and operators. There is no indication that language selection is configurable or that the Chinese locale is an intentional, documented constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.