Security audit

OpenSprinkler

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real OpenSprinkler integration, but it gives an agent immediate control over watering operations and controller reboot with limited safety gating.

Review before installing. This skill should only be used if you are comfortable giving an agent password-backed local control of your sprinkler controller, including starting and stopping watering, pausing schedules, disabling automatic operation, setting rain delays, reading logs, and rebooting the hardware. Keep the controller on a trusted local network and require clear user confirmation for disruptive actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill uses sensitive environment variables and local network access to control a physical device, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a user or platform may not realize the skill can reach the network and use credentials to operate the irrigation controller, increasing the risk of unauthorized device control or secret exposure if the skill is misused.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill exposes a reboot_controller capability that can disrupt irrigation operations and temporarily make the controller unavailable, but this power-management capability is not disclosed in the description. Hidden destructive or disruptive actions increase the chance of unsafe or unexpected invocation by upstream agents or users who believe the skill only performs routine monitoring and control.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill metadata describes monitoring and control functions but omits that it can remotely reboot the irrigation controller. That omission can mislead users or orchestrators about the scope and risk of the skill, reducing informed consent and making disruptive actions easier to invoke unexpectedly.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill exposes destructive or disruptive actions such as disabling operation, stopping all stations, setting rain delay, and rebooting the controller without any confirmation, safety interlock, or policy gate. In an agent context, a mistaken or manipulated tool call could immediately interrupt watering schedules or controller availability, causing operational impact.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Several tools can cause real-world state changes with operational or safety consequences, including opening stations, starting programs, disabling operation, stopping all stations, pausing queues, and rebooting hardware, but their descriptions do not define when they are appropriate, what preconditions must be checked, or when they must be refused. In an agent setting, missing trigger constraints increases the chance of accidental, ambiguous, or prompt-induced execution of destructive actions against physical infrastructure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.