Dirigera Control (IKEA smart home)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:30 AM UTC
• Version: 1.0.3

Overview

This skill appears purpose-built for IKEA Dirigera smart-home control, but it needs careful review because it stores a hub control token insecurely and can perform broad live device actions.

Install only if you intend to let an agent control your IKEA Dirigera home devices. Treat the generated token as a secret, store it privately or delete it after use, avoid exposing the hub through a tunnel unless you fully control access, and require explicit confirmation before any whole-home or outlet shutdown action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to use shell commands, read and write local files, and access the network, but it declares no corresponding permissions or safety boundaries. This creates a capability/authorization mismatch where a user may invoke powerful operations without transparent consent controls, including network scanning and credential handling.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation text is broad enough to trigger on many generic smart-home requests, which can cause the agent to select this skill in situations beyond the intended environment. Because the skill can perform network operations and control physical devices, overbroad routing increases the chance of unintended device actions or exposure of sensitive setup steps.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill tells the agent to generate an API token and save it to a plaintext file, then read it back, without warning that the token is a sensitive credential or defining secure storage practices. If that file is exposed through logs, workspace access, backups, or other tools, an attacker could gain persistent control over the user's smart-home hub and devices.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These examples perform broad, destructive batch actions across all lights and outlets with no confirmation step, scoping safeguard, or cautionary warning. In a smart-home control skill, users or downstream agents may copy these patterns directly, increasing the chance of accidental whole-home shutdowns that disrupt occupants or power important devices.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The energy-saving example automatically turns off all lights and all outlets outside an 'essential rooms' list, which is an error-prone proxy for safety and can disable legitimate or safety-relevant equipment. Because this skill is explicitly for controlling a live IKEA Dirigera environment, the example is operationally dangerous if reused without additional validation and user confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script writes a bearer access token directly to disk in plaintext, which can expose control of the user's smart home environment if the file is read by other local users, backup systems, or malware. In this skill context, the token grants access to home automation devices, so compromise could enable unauthorized device control and privacy-impacting actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The bulk shutoff helpers can change the state of every light or outlet in a room or home without any built-in confirmation, scope restriction, or safety interlock. In a smart-home control skill, these functions increase the risk of accidental or unauthorized disruptive actions, especially for outlets that may power important devices.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

}

    try:
        response = requests.get(auth_url, params=params, verify=False, timeout=10)
        response.raise_for_status()
        auth_code = response.json()["code"]
        print(f"✓ Authorization code received")

• Confidence: 97% confidence
• Finding: verify=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

token_url,
                headers=headers,
                data=data,
                verify=False,
                timeout=5
            )

• Confidence: 98% confidence
• Finding: verify=False

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.