Security audit

Mijia Control

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Xiaomi smart-home controller, but it also handles powerful account credentials, polls lock events for occupancy-based automation, and ships household-specific identifiers with several under-scoped safety controls.

Review carefully before installing. Use only with a Xiaomi account and devices you control, pin and isolate the micloud dependency, avoid command-line passwords, rotate any password previously entered that way, protect or remove cached device and state files, and do not enable the lock-triggered fish-feeding cron unless you explicitly want occupancy-derived automation. Replace bundled home and device IDs with your own local configuration before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Third-Party Dependency Executes in the Credential-Handling Process
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mijia.py:62
Finding: Xiaomi Password Is Exposed Through Echoed Input and Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mijia.py:91
Finding: Sensitive Device Inventory Cache Is Created Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fish_auto_feed.py:40
Finding: Occupancy-Related Automation State Is Stored Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/devices.json:30
Finding: Account-Specific Household Identifiers Are Embedded in the Distributed Project
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes an on-demand Xiaomi device control skill, but the documentation also includes unattended polling of door-lock history, leave-home inference, cron-based automation, and automated fish feeding. This hidden expansion from user-requested control to surveillance-like monitoring and autonomous actuation materially changes the trust model and can surprise users or operators.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script implements autonomous behavior driven by lock telemetry rather than user-requested Xiaomi device control, which materially exceeds the declared skill purpose. In a smart-home skill, hidden automation tied to occupancy signals can create unexpected physical-world actions and erodes user consent and reviewability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents shell execution, file reads, and file writes but declares no explicit tool scope or permissions boundary. That makes the agent’s effective authority ambiguous and increases the risk of overbroad execution, especially because the skill can access credential files, write state files, and issue device-control commands.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: | Control Xiaomi Mi Home (米家) smart devices via Xiaomi Cloud API. Use when: user wants to control smart home devices (lights, AC, heater, bath heater, switches, etc.), check device status, or create automation scenes. Triggers: "开灯", "关灯", "开空调", "关空调", "开浴霸", "我要洗澡", "设备状态", "创建场景", "自动化", "米家", "smart home", "turn on/off", any home device control request. NOT for: non-Xiaomi devices, HomeKit-only devices.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match ordinary conversation, including generic terms like 'smart home', 'turn on/off', and 'any home device control request'. Overbroad activation can cause accidental invocation of shell-backed device actions, resulting in unintended changes to real-world devices or automations.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
Prerequisites: pip3 install micloud

Credentials: ~/.mijia_creds.json (chmod 600)

json
{"userId":"...", "serviceToken":"...", "ssecurity":"...", "cUserId":"..."}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation describes how to obtain and store long-lived Xiaomi session credentials, including service tokens and ssecurity values, without strong warnings about their sensitivity or handling controls. Exposure of these tokens could allow unauthorized access to the user’s Xiaomi cloud account and device fleet.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The fish-feeding workflow extends the skill from direct smart-home control into continuous polling of door-lock events and automated actuation based on inferred occupancy. This introduces privacy exposure and autonomous physical-world effects that are not obvious from the primary skill description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The XiaoAI TTS feature adds a speaker-broadcast capability that is not declared in the manifest description or use cases. Undeclared audio output can be abused for spoofing, disruption, or privacy-invasive announcements, and users may not expect a device-control skill to speak aloud.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The registry exposes control metadata for a smart lock and router, which are materially more sensitive than ordinary lights or HVAC devices and exceed the skill’s narrowly described examples. In a home-control skill, including these identifiers increases the chance of unintended or unauthorized actions against security-critical infrastructure if prompt routing, name matching, or future tool logic is too permissive.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The scene metadata introduces a lock-event-driven fish-feeding automation that is outside the stated device-control scope and links a physical security event to an unrelated actuator. This kind of hidden cross-device automation expands behavior beyond user expectations and can create covert or unintended actions when the skill is used or extended.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The top-level documentation presents a successful once-per-day feeding flow, but the implementation explicitly saves last_feed_date regardless of API success and prints 'Will NOT retry today' on failure. That behavior contradicts the docstring's implied outcome because a failed run can still consume the day's feeding opportunity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script reads smart-lock event history to infer whether the user has left home, which is sensitive occupancy/behavioral data not obviously necessary for the stated purpose of direct device control. This broadens the skill from command execution into surveillance-like inference, increasing privacy risk and enabling unintended presence tracking.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/mijia.py (reported line 12)May include surrounding context.
python
python3 mijia.py status <did> # Read device properties python3 mijia.py set <did> <siid> <piid> <val> # Set a device property python3 mijia.py get <did> <siid> <piid> # Get a device property python3 mijia.py scene_create <json_file> # Create automation scene python3 mijia.py scene_list # List automation scenes python3 mijia.py batch <json_file> # Execute batch commands

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code forces zh_CN, GMT+08:00, and the cn server/region, which is a natural-language locale policy concern because it imposes a fixed language/locale context without opt-in. The file does not explain that this is a required region-specific tool or provide a configurable alternative.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script reads the Xiaomi password using input(), which echoes the secret to the terminal and exposes it to shoulder surfing, screen recording, or captured terminal sessions. It also accepts --password on the command line, which can leak through shell history and process listings, making credential compromise more likely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes controlling Xiaomi smart home devices, checking status, and creating automation scenes, with examples like lights, AC, heaters, and switches. This function adds a separate capability to make a XiaoAI speaker speak arbitrary text, including volume/unmute/playback manipulation, which is not described in the manifest or trigger/use guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The _doc string says device lookup is performed "by Chinese name," which imposes a Chinese-language naming convention. This is a natural-language locale constraint with no indication of user choice, opt-in, or justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The default value for the scene name is the Chinese string "场景名称", which imposes a specific language in a natural-language field. Because the template does not indicate that this is optional, localized, or intended only for a Chinese-region deployment, it can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script persists feeding state to a hidden file in the user's home directory via STATE_FILE.write_text(...), but there is no user confirmation around this write and the module docstring does not mention that local state will be stored. For a code file, file writes should have at least some visible disclosure through comments, logging, or documentation unless clearly warned elsewhere.
Content: No source excerpt is available for this finding.