Security audit

Tuya Smart Control

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Tuya smart-home integration, but it needs review because it can control devices and handle camera media while endpoint, consent, and image-processing disclosures are too loose.

Install only if you are comfortable giving the skill a Tuya API key that can control devices, read home/device/location/statistics data, send self-notifications, monitor events, and capture camera media. Keep endpoints restricted to official Tuya hosts, require explicit confirmation for physical actions and camera capture, avoid unattended automation for sensitive devices, and ask the publisher to pin dependencies and fully disclose AI image-processing destinations.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/tuya_api.py:89
Finding: API Key Can Be Transmitted to an Arbitrary REST Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/tuya_device_mq_client.py:97
Finding: API Key Can Be Transmitted to an Arbitrary WebSocket Server
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/tuya_api.py:346
Finding: Camera Capture Helpers Implicitly Assert User Privacy Consent
Content: View full analysis
dict: ``` ```python def ipc_ai_capture_pic_allocate_and_fetch( self, device_id: str, user_privacy_consent_accepted: bool = None, pic_count: int = None, home_id: str = None) -> dict: """Allocate a PIC capture then automatically wait and resolve. Args: device_id: Device ID user_privacy_consent_accepted: True for decrypted URLs (default True) pic_count: Number of snapshots (1-5) home_id: Optional home ID """ if user_privacy_consent_accepted is None: user_privacy_consent_accepted = True ``` ```python def ipc_ai_capture_video_resolve_with_wait( self, device_id: str, allocate_result: dict, user_privacy_consent_accepted: bool = True, home_id: str = None, poll_timeout: int = 120, retry_count: int = 3) -> dict: ``` ```python def ipc_ai_capture_video_allocate_and_fetch( self, device_id: str, video_duration_seconds: int = 10, user_privacy_consent_accepted: bool = None, home_id: str = None) -> dict: """Allocate a VIDEO capture then automatically wait and resolve. Args: device_id: Device ID video_duration_seconds: Video duration in seconds (1-60, default 10) user_privacy_consent_accepted: True for decrypted URLs (default True) home_id: Optional home ID """ if user_privacy_consent_accepted is None: user_privacy_consent_accepted = True ``` ### Technical Analysis The camera helper APIs treat an omitted consent decision a ...[truncated 1541 chars]
Remediation: View remediation

other

Error

Location: SKILL.md:257
Finding: Camera Images Are Sent to an Unspecified Vision Model Without Complete Egress Disclosure
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/requirements.txt:1
Finding: Security-Sensitive Dependencies Are Not Reproducibly Pinned
Content: View full analysis
=2.28.0,<3.0.0 websockets>=12.0 ``` ### Technical Analysis The dependency specification permits installation of future releases that were not reviewed with this Skill. No lockfile, package hashes, or trusted-index restrictions are supplied. `websockets>=12.0` has no upper bound, and `requests` accepts any compatible release below 3.0. These libraries execute in the same Python process that stores `TUYA_API_KEY`, sends device commands, receives real-time device events, and handles camera-related data. Consequently, compromise of an accepted dependency release or package source would expose high-value credentials and smart-home capabilities. This finding does not establish that the named packages are currently malicious. The vulnerability is the non-reproducible, non-integrity-checked installation policy. ### Attack Path 1. A dependency account, distribution channel, package index, or future compatible release is compromised. 2. The Skill is installed or updated after the compromised version becomes the latest version satisfying the ranges. 3. The package manager resolves and installs the compromised release because no exact version or hash prevents it. 4. The malicious package executes when imported by the Skill. 5. It reads process credentials or intercepts REST/WebSocket traffic and exfiltrates data or alters commands. ### Impact Assessment A compromised dependency would run with the permissions of the Skill process. It could read environment variables, including `TUYA_API_KEY`; access device and camera data in memory; change API requests; capture notification contents; and access any files or network resources available to the Agent runtime. The scope therefore includes both the Tuya account and the local process ...[truncated 16 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tuya_api.py:520
Finding: Notification Contents Are Disclosed in Error Logs
Content: View full analysis
list: """Truncate notification message content in args for safe display.""" if command not in _SENSITIVE_COMMANDS: return args redacted = [] for arg in args: if isinstance(arg, str) and len(arg) > _MAX_ARG_DISPLAY_LEN: redacted.append(arg[:_MAX_ARG_DISPLAY_LEN] + "...") else: redacted.append(arg) return redacted ``` ```python def _print_error(command: str, args: list, message: str, code: int = None): """Print a standardized error block to stderr.""" safe_message = _sanitize_message(message) safe_args = _redact_args(command, args) print(f"Error: {safe_message}", file=sys.stderr) print(f"Command: {command}", file=sys.stderr) print(f"Args: {json.dumps(safe_args, ensure_ascii=False)}", file=sys.stderr) if code is not None: print(f"TuyaErrorCode: {code}", file=sys.stderr) print(f"Suggestion: {_error_suggestion(code)}", file=sys.stderr) ``` ### Technical Analysis The function is named `_redact_args`, but it does not actually redact notification content. Messages of 80 characters or fewer are logged in full, while longer messages disclose their first 80 characters. Email and push subjects are also included. Error output may be captured by Agent runtimes, shell histories, centralized log systems, monitoring services, or support bundles. API-key redaction in `_sanitize_message()` does not protect command arguments. The issue affects `sms`, `voice`, `mail`, and `push`, which are explicitly classified as sensitive commands. ### Attack Path 1. A user sends a private SMS, voice message, email, or push notification through the CLI. 2. The operation fails because of an API, network, validatio ...[truncated 730 chars]
Remediation: View remediation
"`. 2. Never retain a prefix of notification content. 3. Redact subject and body fields independently for email and push commands. 4. Log only non-sensitive metadata, such as argument count and content length. 5. Avoid printing raw arguments for control and rename operations if they may also contain sensitive household information. 6. Add unit tests confirming that no part of sensitive inputs appears in error output. 7. Review runtime logging and retention policies and remove previously captured sensitive logs where feasible. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code substantially matches most of the declared functionality: device control, status/detail queries, listing devices, home/room management, renaming, weather, notifications, statistics, and IPC snapshot/video capture are all present. However, the description explicitly includes subscribing to real-time device events (property changes, online/offline status) via WebSocket, and the supplied code contains no WebSocket client, subscription methods, or event-stream handling. This is a material description-versus-behavior mismatch, though it is an overstatement rather than an undeclared extra capability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims image operations are unsupported, yet Workflow 9 instructs taking camera snapshots, downloading decrypted image URLs, and analyzing them with an AI model. This contradiction can bypass user and reviewer expectations about sensitive camera-data handling, increasing the chance of covert image exfiltration or privacy-invasive processing.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/notifications.md (reported line 3)May include surrounding context.
md
# Notifications All notification APIs are **self-send** mode — they can only send messages to the currently logged-in user. ## 1. Send SMS

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares access to environment variables and performs network/WebSocket operations, but it does not explicitly constrain tool permissions. That weakens reviewability and increases the risk of unintended data access or outbound communication, especially because the skill handles a sensitive API key and can interact with cameras, notifications, and device control endpoints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill whenever the user asks to control smart devices, query status, manage homes and rooms, check weather by location, send notifications, capture camera media, or subscribe to events. This activation scope is very broad and does not provide explicit boundaries or negative examples, increasing the chance of unintended invocation for ordinary requests like weather checks or notifications that may not be meant for this Tuya skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation introduces IPC visual recognition, which involves downloading decrypted camera snapshots and sending them to an AI vision model, but that capability is omitted from the manifest description. This creates a material transparency gap: users may authorize a smart-home control skill without realizing it can process private camera imagery, raising privacy and consent risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This documentation describes issuing live device-control commands that can change the state of physical devices, but it does not include any warning, confirmation guidance, or safety considerations before performing state-changing actions. In a smart-home control skill, omission of such guardrails can lead to accidental or unauthorized activation of appliances, lighting, plugs, or climate systems, creating real-world safety and privacy risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation encourages real-time monitoring of device property and online/offline events, which can reveal occupancy, routines, and other sensitive household activity patterns. While this is expected functionality for a smart-home integration, the lack of any privacy warning, retention guidance, or access-control considerations makes it easier for downstream users to collect and expose sensitive behavioral data without realizing the risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The automation example performs a physical action on a device when a sensor event occurs, but it does not explicitly warn that example code can affect real-world devices and environments. In a smart-home context, state changes can have safety, security, nuisance, or cost implications if copied blindly or adapted to more sensitive devices, especially when triggered automatically from noisy or spoofed events.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This documentation enables capture and retrieval of camera snapshots/videos, which are highly privacy-sensitive, but the warning about consent appears later in the document rather than as an upfront gating requirement. In the context of a natural-language smart-home control skill, this increases the risk that an agent or integrator could implement covert or insufficiently consented surveillance flows using decrypted media URLs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file explicitly states that w.condition.0 is an English description and repeats that w.condition is an English-only weather condition description. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation, and this documentation does not offer any language choice or explain a necessary regional constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The IPC capture helpers can trigger camera snapshots and videos and, by default, set user_privacy_consent_accepted to True when no explicit value is provided. In the context of a natural-language smart home control skill, this creates a real privacy risk because an agent or caller could collect sensitive in-home camera data without a clear user-facing confirmation or friction at the point of action.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The monitoring workflow activates on phrases like "monitor device changes in real time" or "watch for property updates," which are generic enough to match many non-Tuya contexts. The document does not state limiting conditions such as requiring an existing Tuya device scope or explicit Tuya context before activation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file documents an operation that changes a device's custom name, which affects user-managed device metadata. The description presents the action plainly but does not include any warning or note that the operation updates persisted device information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file documents APIs that return a user's full device inventory, room/home associations, and current device property states such as presence-related or behavioral signals. The description does not include any user warning or privacy note about accessing potentially sensitive household/device metadata, which falls under missing warnings for markdown files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The markdown describes returning precise home latitude and longitude values and suggests reusing them for another API, but it does not include any warning that this is sensitive location data. For a skill/reference document, location-related behavior can affect user privacy and should be disclosed clearly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This documentation states that hourly statistics for all devices under the current user are queried and that user identity is automatically obtained from the login context, but it does not include any user-facing warning about accessing potentially sensitive usage data. For markdown files, SQP-2 applies when the skill description omits warnings about behavior that could affect user data or privacy.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: requests is constrained only to a broad version range, so it is not possible to verify from this manifest whether deployment will select a version affected by known CVEs. Because this skill likely performs authenticated outbound API calls to Tuya services, unresolved dependency versions can expose it to credential leakage, TLS/verification issues, or other client-side flaws if an affected release is installed.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency websockets>=12.0 is not fully pinned, so builds may resolve to different versions over time, including newly introduced vulnerable or breaking releases. In a smart-home control skill that may maintain persistent WebSocket connections for real-time device events, supply-chain drift and unreviewed upgrades increase the risk of denial of service or exposure to library-level flaws.
Content: Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.
text
requests>=2.28.0,<3.0.0 websockets>=12.0

Unverifiable Dependency: websockets has 4 known advisory(ies) (CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: websockets is also left unpinned, making it impossible to determine whether the installed version is affected by published vulnerabilities. Given the skill advertises WebSocket-based real-time device event subscriptions, a vulnerable websockets release could increase exposure to denial-of-service or protocol-handling weaknesses in a component central to its functionality.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.