Security audit
Shelly Plug S Gen3
Security checks for vulnerabilities and agentic risk
Overview
This is a narrow SmartClaws device contract for a Shelly smart plug, with disclosed telemetry and relay-control behavior.
Install only in a SmartClaws setup where you control the Shelly plug and channels. Because the contract can lead a bridge to turn a physical relay on or off, confirm the configured device, channel addresses, and credential storage before enabling command mode.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.