Midea Air Conditioners

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:39 AM UTC
• Version: 0.0.3

Overview

This skill appears intended to control local Midea air conditioners, but its instructions leave real device actions and shell command construction too loosely scoped for automatic use.

Review before installing. Use only with trusted, explicit room names, and avoid letting an agent build shell commands from arbitrary user text. The skill should be tightened to accept only configured devices such as livingroom and bedroom, require confirmation for ambiguous AC changes, and document safe argument-based execution.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:44

Finding

Untrusted Room Name Interpolated into Shell Command Templates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-51 and 60-63
Vulnerability Type: Command injection through unsafe command construction guidance
Risk Level: High

The skill instructs the Agent to substitute a user-provided room name directly into shell command templates:

markdown

| User Says | Command |
|-----------|---------|
| Turn on the <room-name> AC / open AC | `scripts/midea_ac.py <room-name> on` |
| Turn off the <room-name> AC / close <room-name> AC | `scripts/midea_ac.py <room-name> off` |
| Toggle the <room-name> AC | `scripts/midea_ac.py <room-name> toggle` |
| Warmer / more warm | Check status first, then increase temperature by 2 - 10 degrees |
| Cooler / less heat | Check status first, then decrease temperature by 2 - 10 degrees |
| Full speed / maximum | if mode is heat: `scripts/midea_ac.py <room-name> --temperature 30 --fan_speed max`, if mode is cool: `scripts/midea_ac.py <room-name> --temperature 16 --fan_speed max` |
| Minimum speed | `scripts/midea_ac.py <room-name> --fan_speed low` |
| <room-name> AC status / what's the <room-name> status | `scripts/midea_ac.py <room-name> status` |

## Before Executing

1. Navigate to skill directory: `cd ~/.openclaw/skills/midea_ac`
3. Run with uv: `python scripts/midea_ac.py <room-name> <command>`
3. Report the result to the user after execution

Technical Analysis

The <room-name> placeholder originates from natural-language user input. The instructions do not require validation against the configured device names, shell-safe quoting, or execution through a process API that accepts an argument array.

If an Agent follows these instructions by constructing a command string and passing it to a shell, shell metacharacters in the room name may be interpreted as command syntax rather than as one inert argument. Although the Python script itself does not invoke a shell, the vulnerable boundary is the skill's Agent-facing execu ...[truncated 1195 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate room names against an exact allowlist derived from AC_IPS; currently, only livingroom and bedroom should be accepted.
2. Reject unknown names before starting any process instead of inserting them into a command.
3. Execute the script with an argument array, such as ["python", "scripts/midea_ac.py", validated_room, validated_command], with shell processing disabled.
4. Update SKILL.md to explicitly prohibit concatenating natural-language input into shell command strings.
5. Validate commands and option values against explicit allowlists before execution.
6. Add a guard in scripts/midea_ac.py that reports an unknown device and exits before calling Discover.discover_single.
7. Add tests containing spaces, quotes, command separators, substitutions, and redirection characters to confirm that malformed room names are rejected and never interpreted by a shell.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation description is very broad ('Control Midea ACs... when the user wants to control ACs') and does not define clear boundaries, confirmation requirements, or safety checks. In an agent setting, this can cause the skill to activate on loosely related requests and perform real-world device actions unintentionally, especially when user phrasing is ambiguous.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language mappings include ambiguous phrases like 'Warmer', 'Cooler', 'Full speed', and 'Minimum speed' without requiring explicit reference to an AC, room, or target device. Because these phrases are common conversational language, the agent may infer an AC control action from general discussion or vague comfort requests and execute commands that change a physical environment unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script returns status and action messages in Chinese string literals for all normal operations and errors. This enforces a specific language for all users without opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.