Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent pet-robot control skill, but it handles a powerful access key and physical/privacy-sensitive device controls with some overbroad and under-protected paths.
Review before installing. Use only official HTTPS Ecovacs gateways, avoid setting ECOVACS_PORTAL_URL unless you trust the endpoint, prefer ECOVACS_AK over set-ak storage, protect or delete ~/.ecovacs_session.json if used, and require clear user intent before enabling camera/mic, moving the robot, playing repeated sounds, resetting, or scheduling routines.
scripts/ecovacs.py:58Unrestricted Gateway Override Can Disclose the Access Key
scripts/ecovacs.py:80Access Key Stored Without Explicit Restrictive File Permissions
The request destination is derived from ECOVACS_PORTAL_URL via portal_base(), and that environment-controlled value is used to build URLs passed into urlopen without any allowlist or host validation. If an attacker can influence the environment or execution context, they can redirect requests containing the user's access key and device commands to an arbitrary server, causing credential exfiltration and unauthorized robot control.
def http_get_json(url):
req = urlreq.Request(url, headers={"Accept": "application/json"})
with urlreq.urlopen(req, timeout=45) as resp:
return json.loads(resp.read().decode("utf-8"))
POST requests send sensitive material directly to the environment-controlled portal endpoint, including the AK in the JSON body and robot control payloads. A malicious or compromised ECOVACS_PORTAL_URL can therefore receive the credential and all issued commands, enabling full misuse of the linked pet robot account/device integration.
data=data,
headers={"Content-Type": "application/json", "Accept": "application/json"},
)
with urlreq.urlopen(req, timeout=45) as resp:
return json.loads(resp.read().decode("utf-8"))
The documented automatic wake-up behavior explicitly enables the camera and changes work mode before sending display/motion actions, but it does not present this as a prominent privacy/security warning requiring consent. That means a routine action can silently transition the device into a more privacy-sensitive state and alter its operating mode, surprising users and potentially exposing camera functionality without informed approval.
The README advertises capabilities that can change privacy- and integrity-sensitive device settings and behavior, including microphone/camera toggles, wake word/nickname changes, sound/motion execution, and scheduled routines, but it does not prominently warn that these actions can affect surveillance, device behavior, or nearby people/pets. In an agent skill context, normalizing these controls without explicit consent guidance increases the risk of unauthorized or socially engineered use, especially because the skill is designed for natural-language execution.
The README advertises microphone/camera changes and physical robot actions without clearly warning users about privacy implications or real-world side effects. In a voice/agent skill context, commands that can enable sensing or trigger device movement are safety-relevant because users may not realize they are authorizing surveillance-affecting changes or physical behavior.
The skill documents and encourages use of environment variables, network requests, and script execution, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this can lead to overbroad execution authority, making it easier for an agent to access secrets, write files, or perform networked control actions beyond what a user expects.
This skill controls a physical robot, including movement, display changes, audio, and settings, yet the introductory usage flow lacks a clear safety warning that commands can trigger real-world motion and state changes. Users or downstream agents may invoke actions without appreciating the physical, privacy, or nuisance risks to nearby people, pets, or property.
The skill instructs users to send the Access Key in a query string for the device list endpoint and in HTTP requests to external Ecovacs gateways. Transmitting credentials to external services is expected for this integration, but placing secrets in URLs is riskier because query strings are commonly logged by shells, proxies, browser history, and monitoring systems.
Device list
curl -sS "${BASE_URL}/robot/skill/deviceList?ak=YOUR_AK"
Pet control
The example sends the Access Key in a GET query string, which is commonly recorded in browser history, proxy logs, server access logs, monitoring tools, and referrer-like telemetry. Exposure of the AK could permit unauthorized API use, including device discovery and potentially follow-on control actions against FAMIBOT devices.
curl -sS "${BASE_URL}/robot/skill/deviceList?ak=YOUR_AK"
POST with body {"ak":"<AK>"} is also supported. On success, data[] lists devices; product_category: FAMIBOT identifies pet robots.
This markdown file describes potentially disruptive operations such as putting the device to sleep and resetting it, including cancellation of already queued timed actions. The surrounding documentation provides usage details and examples but does not warn users that these commands can interrupt ongoing behavior or clear scheduled actions.
This code exposes user-facing natural language in Chinese, including the routine label and the error message, and several aliases are Chinese-only. It does not offer a language choice or document that the skill is intentionally limited to a Chinese-speaking locale, which violates the language/locale policy criteria.
The file states 'Default: English' while offering a Chinese alternative, which imposes a language default rather than presenting language selection neutrally. SQP-3 flags language or locale policy violations when a specific language is forced without explicit user opt-in.
The file presents the skill documentation entirely in Chinese and includes region-specific setup guidance, but it does not clearly state that language/locale is user-selectable when interacting with the skill. Because SQP-3 covers natural-language policy issues around forced language or locale, this may indicate a language constraint without explicit opt-in.
The documentation instructs users to place the Access Key directly in requests but does not warn that the AK is a sensitive credential. This increases the chance the key will be copied into shell history, screenshots, logs, or shared examples, which could allow unauthorized control of the user's robot devices if exposed.
The entire skill file is written in Chinese and provides no indication that other languages are supported or that the user can choose their preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
A language or locale policy issue can arise when a skill forces a specific language without offering user choice. This file presents all instructions and examples exclusively in Chinese, with no indication that the language is optional, configurable, or intentionally limited to a specific audience.
This code file contains extensive natural-language instructions and user-facing text exclusively in Chinese, including the module docstring and command help. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly justified.