Workswith Claw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:00 AM UTC
• Version: 1.0.3

Overview

This smart-home skill is coherent with its purpose, but it exposes home data and automation controls with insufficient authentication and unsafe credential handling.

Review carefully before installing. Only run this on a trusted, firewalled host; require authentication before exposing any API or dashboard; avoid host networking unless necessary; use HTTPS to Home Assistant; rotate any HA token entered into the dashboard; and treat occupancy, device inventory, and automation creation as administrator-only capabilities.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/main.py:29

Finding

Missing Authentication Across Sensitive and State-Changing APIs

Content

View full analysis

str: """验证 API Key""" # 如果没配置 API Key，跳过验证 if not API_KEY: return "dev" # 验证 if not api_key: raise HTTPException( status_code=401, detail="请提供 API Key" ) if api_key != API_KEY: raise HTTPException( status_code=403, detail="API Key 无效" ) return api_key def require_auth(): """认证依赖""" return Depends(verify_api_key) ``` ### Technical Analysis An API-key verification function exists, but none of the application routers or individual endpoints apply `require_auth()` or `verify_api_key`. Consequently, every route is accessible without authentication. The authentication implementation also fails open when `WORKSWITH_CLAW_API_KEY` is empty. This is particularly dangerous because the documented launch command binds the application to `0.0.0.0`, and the Docker configuration leaves the API key empty while using host ...[truncated 1267 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/api/routes/devices.py:18

Finding

Unauthenticated Disclosure of Complete Home Assistant Entity State

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/api/routes/insights_v2.py:35

Finding

Public Exposure of Occupancy, Motion, and Household Activity

Content

View full analysis

0 else '无人'}在家" }, "device_stats": device_stats, "activity_patterns": activity_patterns, "device_patterns": device_patterns, "insights": insights, "timestamp": datetime.now().isoformat() } ``` The area endpoint also exposes motion and entry-related sensor values: ```python if "motion" in entity_id.lower() or "presence" in entity_id.lower(): key_sensors["motion"].append({ "entity": entity_id, "name": friendly_name, "value": state }) if "door" in entity_id.lower() or "window" in entity_id.lower() or "contact" in entity_id.lower(): key_sensors["door_window"].append({ ...[truncated 1381 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/api/routes/apply.py:75

Finding

Unauthenticated Persistent Home Assistant Automation Creation

Content

View full analysis

dict: """创建自动化 YAML 文件""" if insight_type not in AUTOMATION_TEMPLATES: return {"success": False, "error": "未知的洞察类型"} template = AUTOMATION_TEMPLATES[insight_type].copy() if params: if "time" in params: template["trigger"][0]["at"] = params["time"] if "temperature" in params: template["action"][0]["data"]["temperature"] = params["temperature"] if "brightness" in params: template["action"][0]["data"]["brightness"] = params["brightness"] os.makedirs(AUTOMATIONS_DIR, exist_ok=True) filename = f"wc_{insight_type}.yaml" filepath = os.path.join(AUTOMATIONS_DIR, filename) with open(filepath, 'w', encoding='utf-8') as f: yaml.dump([template], f, allow_unicode=True, default_flow_style=False) return { "success": True, "file": filepath, "automation": template } @router.post("/apply") async def apply_automation(request: ApplyRequest): """采纳洞察，创建自动化""" result = create_automation_file(request.insight_type, request.params) if result["success"]: return { "success": True, "message": f"自动化已生成: {result['file']}", "file": result["file"], "automation": result["automation"], "yaml": yaml.dump([result["automation"]], allow_unicode=True, default_flow_style=False) } ``` ### Technical Analysis The `/apply` endpoint writes directly into `~/.homeassistant/automations` without authenticating the caller. A caller can select a predefined automation and provide custom `time`, `temperature`, or `brightness` values. The target filename is constrained by ...[truncated 1499 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: static/dashboard.html:481

Finding

Home Assistant Long-Lived Token Stored in Browser Local Storage

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: static/dashboard.html:460

Finding

Dashboard Cross-Site Scripting Through Unsanitized Home Assistant Data

Content

View full analysis

${names[domain] || domain}${g.count} 个

`; for (const d of g.devices.slice(0, 5)) { html += `

${d.attributes.friendly_name || d.entity_id}${d.state}

`; } if (g.devices.length > 5) html += `

还有 ${g.devices.length - 5} 个...

`; html += `

`; } document.getElementById('device-list').innerHTML = html || '暂无设备'; } catch(e) { document.getElementById('device-list').innerHTML = '加载失败'; } } ``` A second sink renders semantic data in the same unsafe manner: ```javascript for (const dev of devices.slice(0, 4)) { const tags = dev.tags || []; html += `

${dev.friendly_n ...[truncated 2073 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/services/ha_client.py:12

Finding

Long-Lived Home Assistant Bearer Token May Be Sent Over Plaintext HTTP

Content

View full analysis

aiohttp.ClientSession: """获取或创建会话（复用连接）""" if self._session is None or self._session.closed: self._session = aiohttp.ClientSession( headers={"Authorization": f"Bearer {self.token}"}, timeout=aiohttp.ClientTimeout(total=30), connector=aiohttp.TCPConnector( limit=100, limit_per_host=30 ) ) return self._session ``` The documented configuration also recommends plaintext HTTP: ```env HA_URL=http://192.168.x.x:8123 HA_TOKEN=你的令牌 ``` ### Technical Analysis The application supports and recommends Home Assistant URLs using unencrypted HTTP while attaching a long-lived bearer token to each request. HTTP provides neither confidentiality nor server authenticity. An attacker able to observe local-network traffic can recover the Authorization header. An active network attacker can also modify Home Assistant responses or redirect traffic through spoofing techniques. Because the credential is long-lived, compromise can remain useful well after the intercepted request. ### Attack Path 1. The service is configured with an `http://` Home Assistant URL, as shown in the documentation and d ...[truncated 581 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (105)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 90)May include surrounding context.

md

pip install -r requirements.txt

# 3. 配置环境变量
cp .env.example .env
# 编辑 .env，填写 HA 地址和 Token

# 4. 启动服务

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 198)May include surrounding context.

bash

   docker run -d \
     --name homeassistant \
     --privileged \
     --network=host \
     -v ~/ha:/config \
     homeassistant/home-assistant:stable

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 199)May include surrounding context.

docker run -d
--name homeassistant
--privileged
--network=host
-v ~/ha:/config
homeassistant/home-assistant:stable

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

A system that primarily executes scenes, tasks, and HA service calls has direct actuation power over the physical environment, which is more sensitive than the abstract 'middleware' description suggests. In a smart-home context, undocumented actuation can affect locks, climate, cameras, alarms, or power devices, increasing safety and privacy risk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill explicitly requires placing a long-lived Home Assistant token in a .env file, indicating access to sensitive credentials. Long-lived local tokens materially increase impact if the host, repository, logs, backups, or process environment are exposed, because the token can be reused to control the smart-home environment.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

pip install -r requirements.txt

配置环境变量

cp .env.example .env

编辑 .env，填写 HA 地址和 Token

text

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The requirements file pins FastAPI to 0.109.0, and the static analysis indicates this version is affected by a published advisory. Even though this file alone does not prove the vulnerable code path is exercised, shipping a known-vulnerable web framework in a smart-home middleware service increases exposure because it likely processes network requests and may be internet- or LAN-accessible.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.