ClawHub
Back to skill

Security audit

Tuya Smart

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Tuya Smart API helper that discloses its credential, cloud API, local note, and device-control behavior.

Install only if you intend to let an agent help with Tuya cloud operations. Keep Tuya credentials in local environment variables, review any proposed device write or automation plan before approval, and treat ~/tuya as a local operational notebook that may contain device IDs, endpoint choices, and automation constraints.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Memory Manipulation

High
Category
Memory Poisoning
Content
- Define desired end state per device.
- Sort execution order by dependency.
- Write idempotent steps so re-run does not corrupt state.
- After each phase, verify aggregate state before next phase.

## Playbook 3: Incident Containment
Confidence
90% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Credential Access

High
Category
Privilege Escalation
Content
## Symptom: Authentication Fails Immediately

Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Symptom: Authentication Fails Immediately

Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Symptom: Authentication Fails Immediately

Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Symptom: Authentication Fails Immediately

Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Device permissions enabled in the project (Cloud Authorization and required API groups)
- For account-based device binding: configured user permission package and app account flow

Never ask users to paste production secrets into chat logs. Prefer local environment variables and redacted examples.

## Data Storage
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Common Traps

- Choosing the wrong regional endpoint -> valid credentials fail and device lookup appears empty.
- Sending commands without checking function schema -> invalid `code/value` pairs and rejected writes.
- Mixing app-account and cloud-account assumptions -> users appear linked but device control fails.
- Retrying signed requests with stale timestamps/nonces -> repeated signature errors.
- Running bulk commands without staged verification -> large-scale bad state transitions.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
mkdir -p ~/tuya
touch ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md}
chmod 700 ~/tuya
chmod 600 ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md}
```
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
mkdir -p ~/tuya
touch ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md}
chmod 700 ~/tuya
chmod 600 ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md}
```

5. If `memory.md` is empty, initialize it from `memory-template.md`.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.