Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Tuya Smart API helper that discloses its credential, cloud API, local note, and device-control behavior.
Install only if you intend to let an agent help with Tuya cloud operations. Keep Tuya credentials in local environment variables, review any proposed device write or automation plan before approval, and treat ~/tuya as a local operational notebook that may contain device IDs, endpoint choices, and automation constraints.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Define desired end state per device.
- Sort execution order by dependency.
- Write idempotent steps so re-run does not corrupt state.
- After each phase, verify aggregate state before next phase.
## Playbook 3: Incident Containment
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Symptom: Authentication Fails Immediately
Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Symptom: Authentication Fails Immediately
Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Symptom: Authentication Fails Immediately
Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Symptom: Authentication Fails Immediately
Checks:
- Confirm Access ID and Access Secret are from the active project.
- Confirm endpoint region matches project data center.
- Confirm request timestamp is current.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Device permissions enabled in the project (Cloud Authorization and required API groups)
- For account-based device binding: configured user permission package and app account flow
Never ask users to paste production secrets into chat logs. Prefer local environment variables and redacted examples.
## Data Storage
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Common Traps
- Choosing the wrong regional endpoint -> valid credentials fail and device lookup appears empty.
- Sending commands without checking function schema -> invalid `code/value` pairs and rejected writes.
- Mixing app-account and cloud-account assumptions -> users appear linked but device control fails.
- Retrying signed requests with stale timestamps/nonces -> repeated signature errors.
- Running bulk commands without staged verification -> large-scale bad state transitions.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/tuya
touch ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md}
chmod 700 ~/tuya
chmod 600 ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md}
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/tuya touch ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md} chmod 700 ~/tuya chmod 600 ~/tuya/{memory.md,environments.md,devices.md,automations.md,incidents.md}
5. If `memory.md` is empty, initialize it from `memory-template.md`.