Sonoff

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:06 AM UTC
• Version: 1.0.0

Overview

The Sonoff skill is a disclosed smart-home automation guide that uses local notes and eWeLink or LAN access only for user-approved SONOFF operations.

Install only if you are comfortable letting the agent help operate SONOFF devices. Start in read-only or guided-write mode, use least-privilege eWeLink credentials, keep tokens out of notes and chat, and require confirmation before switching relays, security-sensitive devices, heating loads, or batches.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

- Cloud mode uses `EWELINK_API_TOKEN` from environment.
- LAN and DIY local mode may not require cloud token but still require device eligibility and reachability checks.
- iHost local API uses short-lived local access token flow.

## Auth Rules

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Cloud mode uses `EWELINK_API_TOKEN` from environment.
- LAN and DIY local mode may not require cloud token but still require device eligibility and reachability checks.
- iHost local API uses short-lived local access token flow.

## Auth Rules

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- For cloud operations: `EWELINK_API_TOKEN` in environment
- For LAN and DIY mode operations: device supports LAN/DIY mode and local reachability

Never ask users to paste production secrets in chat logs. Prefer local environment variables and redacted examples.

## Data Storage

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
mkdir -p ~/sonoff
touch ~/sonoff/{memory.md,environments.md,devices.md,automations.md,incidents.md}
chmod 700 ~/sonoff
chmod 600 ~/sonoff/{memory.md,environments.md,devices.md,automations.md,incidents.md}
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

mkdir -p ~/sonoff
touch ~/sonoff/{memory.md,environments.md,devices.md,automations.md,incidents.md}
chmod 700 ~/sonoff
chmod 600 ~/sonoff/{memory.md,environments.md,devices.md,automations.md,incidents.md}
```

5. If `memory.md` is empty, initialize it from `memory-template.md`.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.