Dirigera Control (IKEA smart home)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:34 AM UTC
• Version: 1.0.3

Overview

This skill is for IKEA smart-home control, but it handles hub tokens and broad device shutdown actions in ways that deserve careful review before installation.

Install only if you are comfortable giving an agent control over IKEA Dirigera devices. Treat the token as a smart-home credential, avoid saving it in shared or synced folders, prefer a protected secret store, and require explicit confirmation before outlet, scene, or whole-home actions. Be especially cautious using token generation on untrusted networks because the script disables TLS certificate checks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

``` 2. Maintain a lock file that records all transitive dependency versions. 3. Require package hashes, such as through `pip install --require-hashes -r requirements.txt`. 4. Document the expected package index and prohibit untrusted alternative indexes. 5. Review dependency updates before changing the pinned version. 6. Run the Skill in a least-privileged environment without access to unrelated secrets or files. 7. Do not allow an agent to install or upgrade dependencies automatically without explicit user authorization. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_token_wrapper.py:17

Finding

OAuth Token Generation Disables TLS Certificate Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_token_wrapper.py:138

Finding

Dirigera Access Token Is Written to a Predictable Plaintext File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/find_dirigera_ip.py:153

Finding

Access Token Can Be Exposed Through Command-Line Arguments

Content

View full analysis

``` ### Technical Analysis The discovery script accepts the Dirigera access token directly on the command line. Command-line arguments may be visible to other local users or monitoring software through process-inspection interfaces while the command is running. They may also be retained in shell history, terminal logs, command auditing systems, automation logs, or diagnostic output. The token is legitimately required when the user requests authenticated verification of candidate hubs. However, passing it through `argv` is not the minimum-exposure input mechanism. ### Attack Path 1. The user invokes the discovery script with `--token` and the actual access token. 2. The token appears in the process argument vector while the script scans candidate addresses. 3. A local user or monitoring process reads the command line from process-inspection facilities, or the shell records it in history. 4. The actor obtains the token from the process listing, history file, audit log, or terminal record. 5. The actor combines the token with the discovered or known hub IP. 6. The actor authenticates to the hub and performs operations allowed by the token. ### Impact Assessment An attacker who obtains the argument can acquire the same hub API privileges as the legitimate token holder. Depending on the Dirigera API authorization scope, this may include: - Enumerating devices and household room metadata. - Reading smart-home operational state. - Controlling lights and outlets. - Triggering scenes. - Observing reachability and battery information. Exploitation requires local a ...[truncated 143 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code substantially matches the core smart-home control portion of the description: it initializes a Dirigera hub, controls lights and outlets, checks status, reports unreachable devices, and checks controller battery levels. However, the declared description includes several capabilities not present in this code chunk: scene control, API token generation, hub IP discovery, and Cloudflare tunnel/VPS accessibility. It also mentions adjusting color, but the code only supports color temperature, not general color selection. Because these are user-facing declared capabilities and access modes not implemented in the supplied code, this is a description/behavior mismatch, though the primary domain and most core functions do align.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs use of shell commands, local file reads/writes, and network interaction, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can cause the skill to run with broader-than-necessary authority, increasing the chance of unintended network scanning, token handling, or filesystem access beyond what users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation text is broad enough to match many generic smart-home requests, which can cause the agent to invoke this skill in situations the user did not specifically intend. Because the skill can control physical devices and initiate discovery/token workflows, over-triggering raises the risk of unauthorized or surprising actions in the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill omits an upfront warning that its commands can immediately change real-world devices such as lights and outlets. In context, this is safety-relevant because users may not realize a natural-language request could trigger physical actions, leading to unintended device operation, nuisance, or disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These examples demonstrate bulk shutdown of all lights or all outlets without any embedded warning, confirmation step, or guidance about scope. In a smart-home control skill, such patterns normalize broad disruptive actions and could be reused by an agent in response to ambiguous prompts, causing unintended home-wide outages or interruption of connected appliances.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The energy-saving example turns off non-essential outlets and then all lights, but provides no warning that the classification of 'non-essential' is hard-coded and may be wrong in a real deployment. In this skill context, controlling physical devices through a hub makes the pattern more dangerous because an agent or user could apply it directly and shut down important equipment, creating safety, availability, or property risks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find_dirigera_ip.py (reported line 42)May include surrounding context.

python

def _arp_ips() -> List[str]:
    """Best-effort ARP table parse."""
    try:
        result = subprocess.run(
            ["arp", "-a"],
            check=False,
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find_dirigera_ip.py (reported line 153)May include surrounding context.

python

print(f"\nTrying generate-token against {ip} ...")
        print("When prompted, press the action button on the Dirigera hub, then hit ENTER.")
        try:
            subprocess.run(
                ["generate-token", ip],
                check=False,
            )

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Disabling TLS certificate verification on the authorization request makes the script trust any certificate presented by the remote endpoint. An attacker on the network path or controlling DNS/routing could impersonate the hub, intercept the OAuth flow, and influence or capture sensitive authentication material.

Content

Scanner excerpt · scripts/generate_token_wrapper.py (reported line 60)May include surrounding context.

python

}

    try:
        response = requests.get(auth_url, params=params, verify=False, timeout=10)
        response.raise_for_status()
        auth_code = response.json()["code"]
        print(f"✓ Authorization code received")

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Disabling TLS verification on the token exchange is especially dangerous because this request carries the authorization code and PKCE verifier and receives the access token. A man-in-the-middle could impersonate the hub and obtain enough material to redeem or return a fraudulent token, leading to unauthorized access to smart home devices.

Content

Scanner excerpt · scripts/generate_token_wrapper.py (reported line 92)May include surrounding context.

python

token_url,
                headers=headers,
                data=data,
                verify=False,
                timeout=5
            )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes a long-lived access token directly to disk in plaintext without setting restrictive permissions or warning the operator that the file is sensitive. On multi-user systems, shared directories, backups, or accidental commits, this can expose the token and allow unauthorized control of the smart home hub.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The helper functions expose home-wide destructive actions such as turning off all lights or all outlets with no confirmation, scoping restrictions, safeguard checks, or high-risk labeling. In a smart-home control skill, these methods can be invoked by higher-level agent logic from ambiguous, mistaken, or maliciously induced requests, causing broad disruption to the user’s environment and potentially powering off safety- or availability-relevant devices connected to smart outlets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation presents state-changing light and outlet control methods without explicitly warning that these commands will immediately affect physical devices. In a smart-home control skill, this can contribute to unsafe or unintended actuation if downstream agents or users treat the examples as harmless read-only operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The scene documentation describes scene.trigger() without warning that a scene can execute multiple device actions at once. In this skill context, scene activation may affect numerous lights, outlets, or automations simultaneously, increasing the risk of unintended physical changes beyond what a user expects from a single command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script uses the literal room name "Køkken" in its example call, which bakes in a locale-specific assumption. For a general-purpose example file, this can conflict with language/locale neutrality expectations because no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.