Midea Cloud Control

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:10 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it stores a Midea account password locally in plaintext and passes it through command-line arguments.

Review this skill before installing if you use a real Midea account. It may work for device control, but it saves your Midea password in a local JSON file and places the password in a process command line during setup. Prefer a version that uses an OS credential manager, enforces 0600-style file permissions, avoids command-line secrets, and documents how to delete saved credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/generated-config-store.md:25

Finding

Midea Cloud Credentials Are Persisted in Plaintext with Unrestricted Default File Permissions

Content

View full analysis

Vulnerability Details

File Location: references/generated-config-store.md:25-28 and references/generated-midea-skill-cli.md:62-67
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: High

Vulnerable Code

references/generated-config-store.md:25-28:

python

def save_config(data: dict[str, Any]) -> Path:
    ensure_dir()
    CONFIG_PATH.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
    return CONFIG_PATH

references/generated-midea-skill-cli.md:62-67:

python

    path = save_config({
        "account": account,
        "password": password,
        "cloud_name": cloud_name,
        "devices": devices,
    })

Technical Analysis

The generated CLI passes the user's Midea account and password directly to save_config(). The configuration store serializes the complete dictionary into unencrypted JSON at ~/.openclaw/midea-cloud-control/config.json.

The file is written using Path.write_text() without explicitly enforcing owner-only permissions. Its effective permissions therefore depend on the host's umask and any permissions already present on the file. In a shared, misconfigured, backed-up, or compromised environment, another local principal or process may be able to read the password.

Encryption at rest alone would not prevent access by a process running as the same user. An operating-system credential manager or dedicated secret service is the preferred storage mechanism.

Attack Path

1. A user invokes the account connection workflow and supplies valid Midea credentials.
2. connect() creates a configuration dictionary containing the plaintext account and password.
3. save_config() serializes that dictionary to ~/.openclaw/midea-cloud-control/config.json.
4. A local process, another user permitted by the resulting filesystem permissions, a backup reader, or malware running in the user's context reads the ...[truncated 672 chars]

Remediation

View remediation

Remediation Suggestions

1. Store the password in the operating system's credential manager, keyring, or another dedicated secret-management service. Persist only a credential reference in config.json.
2. If file-based storage is unavoidable, create ~/.openclaw/midea-cloud-control with mode 0700 and atomically create the configuration file with mode 0600.
3. Validate and correct permissions on an existing directory and file before reading or updating credentials.
4. Avoid following symbolic links when creating or replacing the configuration file, and use an atomic temporary-file-and-rename operation in the same protected directory.
5. Document how users can delete the cached secret and revoke or rotate credentials after suspected exposure.
6. Minimize retained data and avoid storing the password when a renewable token or similarly scoped credential is supported.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53

Finding

Password Is Supplied Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53-55
Vulnerability Type: Credential exposure through process arguments and execution logs
Risk Level: Medium

Vulnerable Code

powershell

uv run python skills_runtime/midea-cloud-control/midea_skill_cli.py connect --account "<ACCOUNT>" --password "<PASSWORD>"

The corresponding generated argument parser is located at references/generated-midea-skill-cli.md:154-165:

python

async def main() -> int:
    parser = argparse.ArgumentParser(description="Unified CLI for the midea-cloud-control skill.")
    sub = parser.add_subparsers(dest="cmd", required=True)

    p_connect = sub.add_parser("connect")
    p_connect.add_argument("--account", required=True)
    p_connect.add_argument("--password", required=True)

    sub.add_parser("list")

    p_toggle = sub.add_parser("toggle")
    p_toggle.add_argument("--device-name", required=True)
    p_toggle.add_argument("--power", required=True, choices=["on", "off"])

Technical Analysis

The documented workflow requires the agent to interpolate the plaintext password into the command line. Command-line arguments may be observable through process-inspection facilities while the process is running. Depending on the execution environment, the complete command may also be retained in shell history, agent tool-call records, orchestration telemetry, diagnostic output, or audit logs.

The instruction not to echo passwords in normal chat responses does not protect process metadata or execution logs. An attacker does not need to modify the command or exploit argument parsing; access to a process listing or retained command record may be sufficient.

Attack Path

1. The user supplies a Midea account password to the agent.
2. The agent substitutes the password into the documented --password argument.
3. The runtime launches the process with the plaintext password in its argument ve ...[truncated 734 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --password command-line option.
2. Read the password interactively with Python's getpass.getpass() when a terminal is available.
3. For noninteractive agent execution, pass the secret through a protected secret channel or an inherited file descriptor rather than the argument vector.
4. If standard input must be used, ensure it is supplied directly to the process and is not embedded in a shell command or logged by the orchestration layer.
5. Configure execution tooling to redact secrets from tool-call records, telemetry, error reports, and debug logs.
6. Ensure the password value is never included in exceptions, structured output, or diagnostic messages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code saves the user's Midea account and password in a local config file, and the skill description does not provide an explicit warning that credentials will be stored. Storing plaintext or recoverable credentials locally creates a significant compromise risk if the workspace, temp directory, logs, backups, or other local processes are accessible.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs the agent to extract Python code from Markdown files, write that code to local helper scripts, and then execute those scripts. Treating text resources inside a skill package as executable code creates a code-generation/execution path that can run attacker-controlled content if the referenced Markdown is modified, substituted, or reviewed insufficiently, and it also establishes persistent local artifacts that survive the immediate session.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

This is a **pure-text publishable skill** for ClawHub.

The uploaded skill folder contains only Markdown/text files. When the skill is first used, OpenClaw should write local helper scripts from the code blocks stored in `references/generated-config-store.md` and `references/generated-midea-skill-cli.md`, then execute those local scripts.

Use this skill only for the **minimum verified workflow**:
- connect a user's Midea cloud account

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The file explicitly documents that the skill stores cloud credentials and cached device metadata in a persistent local config file under the user's home directory. Persisting authentication material on disk creates a real security risk if the file is readable by other local users, included in backups, exfiltrated by malware, or left unencrypted without clear lifecycle controls. The surrounding note about treating physical device behavior as the source of truth is not itself the vulnerability; the actual issue is long-term credential and device-data storage.

Content

Scanner excerpt · references/api-notes.md (reported line 15)May include surrounding context.

md

## Known limitations
- Real-time state reads are not part of this skill.
- Temperature setting is not part of this skill.
- Some successful cloud write calls may print `null` via the library wrapper; treat physical device behavior as the source of truth.

## Local config file
This skill stores credentials and cached device metadata in:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown explicitly instructs the skill to write a Python file into the user's local workspace or a temporary directory on first use, but provides no user-facing warning or consent step. Silent local file creation is risky in an agent setting because it creates persistent artifacts and changes the user's environment beyond answering the immediate request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The embedded code persists configuration under the user's home directory at ~/.openclaw/midea-cloud-control/config.json, again without any warning in the surrounding markdown. In this skill's context, the config is likely to contain Midea account and device information, so undisclosed persistence increases privacy and credential exposure risk if the host is shared, backed up, or later accessed by other tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs writing an executable Python file into the user's workspace or temp directory without an explicit user-facing warning or consent step. Even though the code appears related to the advertised functionality, silent local file creation expands the attack surface, can overwrite or plant executable content, and is risky because skill content must be treated as untrusted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.