Philips Hue Thinking Indicator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Philips Hue light indicator; it has some setup and credential-handling cautions but no artifact-backed malicious behavior.

Install only if you intend to let the assistant control a chosen Hue light. Protect the Hue config file because the username can control lights on your local network, prefer a user-owned PATH install over sudo where possible, and review any shell hook or automatic invocation before adding it to your profile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description frames the skill as a simple light-status indicator, but the documented behavior also includes bridge setup, network discovery/connection, and creation of a Hue API user. That is a meaningful expansion of capability into authentication and local-network interaction, which can mislead users and agents about the true security-sensitive actions the skill performs.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Why Use This?

- **Ambient awareness** — Know when your AI is working without checking screens
- **Flow state protection** — Visual indicator prevents interruptions during deep work  
- **Satisfying completion** — Green light signals "ready for next task"
- **Conversation starter** — "My AI has a physical presence in my house"

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Why Use This?

- **Ambient awareness** — Know when your AI is working without checking screens
- **Flow state protection** — Visual indicator prevents interruptions during deep work  
- **Satisfying completion** — Green light signals "ready for next task"
- **Conversation starter** — "My AI has a physical presence in my house"

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd philips-hue-thinking

# Add to PATH
sudo cp hue /usr/local/bin/
sudo chmod +x /usr/local/bin/hue

# Or add to your shell profile

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd philips-hue-thinking

# Add to PATH
sudo cp hue /usr/local/bin/
sudo chmod +x /usr/local/bin/hue

# Or add to your shell profile

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README says the assistant will 'automatically' use the skill during long tasks but does not define explicit user-consent, trigger conditions, or scope limits. That can lead to unreviewed command execution in agent contexts, increasing the chance of unintended device actions or abuse if an attacker can influence prompts or workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs the agent/user to execute shell commands (`git clone`, `cp`, `chmod`, `source`, and `hue ...`) yet the manifest does not declare any tool scope or allowed-tools boundary. That omission weakens reviewability and policy enforcement, making it easier for an agent to invoke shell actions without explicit consent or least-privilege constraints.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/bin/bash
# Quick Hue setup - run this AFTER pressing the bridge button
curl -X POST http://192.168.1.151/api -d '{"devicetype":"clawdbot#hue"}'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The README shows that bridge IP and API username are stored in a local config file, but it does not clearly warn users that these are sensitive connection details. While not a secret on the level of a password in all contexts, exposing or mishandling the API username can allow unauthorized control of Hue devices on the local network.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The README documents storing a Hue API username in `~/.config/philips-hue/config.json` but does not warn that this value is a credential for controlling smart-home devices. Users may treat it as harmless metadata, leading to insecure file permissions, accidental sharing, or inclusion in backups/repos that expose control of the Hue bridge.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The script appends a user-specific directory to PATH in a shell startup context, which changes command resolution for the entire shell session without warning or validation. This can cause unintended execution of binaries from that directory, and if that location is writable or later compromised, common commands or the `hue` command could be hijacked persistently.

Static analysis

No suspicious patterns detected.