ClawHub
Back to skill

Security audit

Shelly

Security checks for vulnerabilities and agentic risk

Overview

This Shelly skill is a disclosed, purpose-aligned automation guide with explicit safeguards for device writes and credential handling.

Install only if you intend to let an agent help inspect or control Shelly devices. Keep the Shelly cloud token scoped, use environment variables rather than chat, begin in read-only mode, and require explicit confirmation before any relay, heating, lock, alarm, or bulk operation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
- For cloud operations: `SHELLY_CLOUD_TOKEN` set in environment
- For reliable automation: stable device ids, component ids, and execution boundaries

Never ask users to paste production secrets in chat logs. Prefer local environment variables and redacted examples.

## Data Storage

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 35)May include surrounding context.

bash
mkdir -p ~/shelly
touch ~/shelly/{memory.md,environments.md,devices.md,automations.md,incidents.md}
chmod 700 ~/shelly
chmod 600 ~/shelly/{memory.md,environments.md,devices.md,automations.md,incidents.md}

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 36)May include surrounding context.

mkdir -p ~/shelly touch ~/shelly/{memory.md,environments.md,devices.md,automations.md,incidents.md} chmod 700 ~/shelly chmod 600 ~/shelly/{memory.md,environments.md,devices.md,automations.md,incidents.md}

text

5. If `memory.md` is empty, initialize it from `memory-template.md`.