ClawHub
Back to skill

Security audit

Midea Air Conditioners

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local-network controller for Midea air conditioners, with the main caution that vague wording could accidentally change a real device.

Install only if you want an agent to control your local Midea AC units. Verify the room names and IP addresses, install msmart-ng from a trusted source, and require clarification or confirmation before acting on vague requests like 'warmer,' 'cooler,' or 'full speed.'

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill metadata says to use this skill when the user wants to control ACs, which is broad enough to match many generic HVAC-related requests without stronger confirmation that the user intends to control a device. Because this skill performs real-world actions on a home appliance, over-broad invocation increases the chance of unintended execution and unauthorized or mistaken device control.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The natural-language mappings include vague phrases such as 'open AC', 'close AC', 'warmer', 'cooler', 'full speed', and 'maximum', which can overlap with ordinary conversation and be interpreted without enough context. In a device-control skill, this ambiguity can cause unintended changes to temperature, fan speed, or power state, especially when the room name or user intent is not clearly established.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.