ClawHub
Back to skill

Security audit

Alexa

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only Alexa reference skill; its advice is broad and sometimes security-sensitive, but the behavior is disclosed, purpose-aligned, and not executable.

Installers should treat this as a reference guide, not an automation tool. Review privacy and household-access settings before using the listed Alexa commands for locks, cameras, garage doors, calling, messaging, Drop In, or destructive reset steps.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
**Groups vs Scenes:**
- Groups: multiple devices, same action ("turn off downstairs")
- Scenes: multiple devices, preset states ("movie time" → dim lights, close blinds)

**Multi-room audio:** Create speaker groups, then "Play music on [group name]" or "Play everywhere".

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · smart-home.md (reported line 61)May include surrounding context.

md
**Groups vs Scenes:**
- Groups: multiple devices, same action ("turn off downstairs")
- Scenes: multiple devices, preset states ("movie time" → dim lights, close blinds)

**Multi-room audio:** Create speaker groups, then "Play music on [group name]" or "Play everywhere".

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · development.md (reported line 174)May include surrounding context.

md
1. Configure OAuth provider in skill settings
2. User links account in Alexa app
3. Access token available in `handlerInput.requestEnvelope.context.System.user.accessToken`

**Flow:**
1. User enables skill → redirected to your OAuth login

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · development.md (reported line 180)May include surrounding context.

md
1. User enables skill → redirected to your OAuth login
2. User logs in → you redirect back to Amazon with auth code
3. Amazon exchanges code for tokens → stores for user
4. Your Lambda receives access token with each request

---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description says it can 'Control devices, run automations, and help users get more from Alexa' without defining explicit trigger phrases, scope limits, or exclusion conditions. This is broad enough to overlap with many ordinary smart-home support requests, making activation boundaries unclear.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The smart home section includes security-sensitive commands such as locking doors, arming Guard, showing camera feeds, and opening the garage door without any caution about authorization, accidental activation, or privacy implications. In a voice-assistant context, these actions can affect physical security and expose household status or camera content if used by an unauthorized person nearby.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The communication section documents commands for calling, messaging, announcements, and Drop In without warning about unintended outreach, eavesdropping, or privacy exposure. In a shared-home or ambient-voice environment, accidental or unauthorized activation could contact others, broadcast messages across devices, or open live audio/video connections.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The re-registration procedure instructs users to disable skills, delete devices, and potentially factory reset devices, but it does not warn that these actions are destructive, may remove configurations, routines, permissions, and integrations, or should only be performed after confirmation and backup review. In a smart-home context this can cause unnecessary service disruption, lockout risk, and accidental loss of setup state, especially for security-sensitive devices such as locks, cameras, and alarms.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation states as a submission requirement that all required intents are implemented, and earlier it lists Help, Stop, Cancel, and Fallback as required. However, the code example only registers LaunchHandler and OrderPizzaHandler, so the documented expectation is not reflected in the shown implementation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.