smart-control-skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:20 AM UTC
• Version: 1.0.2

Overview

This skill does what it claims, but it controls real smart-home devices and handles a powerful OAuth token with insufficient guardrails.

Review this before installing if you plan to connect it to a real home. Only use it where you are comfortable letting an agent control devices and scenes, keep the MXCHIP token out of chats and logs, avoid custom base URLs, and require confirmation before power, HVAC, curtain, socket, or scene actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mxchip_mcp_client.py:59

Finding

OAuth Bearer Token Can Be Disclosed to an Arbitrary Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/mxchip_mcp_client.py, lines 59-62, 76-87, and 118-122
Vulnerability Type: Unrestricted credential destination
Risk Level: Medium

Vulnerable Code

python

def __init__(
    self,
    oauth_token: Optional[str] = None,
    base_url: str = "https://app.api.cloud.mxchip.com:2443/mcp"
):
    self.oauth_token = oauth_token or os.getenv("MXCHIP_OAUTH_TOKEN")
    if not self.oauth_token:
        raise AuthenticationError(
            "OAuth token required. Set MXCHIP_OAUTH_TOKEN environment variable "
            "or pass oauth_token parameter. Get token at: "
            "https://app.api.cloud.mxchip.com:2443/oauth2/mcp/oauth"
        )

    self.base_url = base_url
    self.headers = {
        "Authorization": f"Bearer {self.oauth_token}",
        "Content-Type": "application/json",
        "Accept": "text/event-stream"
    }
    self.session = requests.Session()
    self.session.headers.update(self.headers)

python

response = self.session.post(
    self.base_url,
    json=payload,
    timeout=30
)

Technical Analysis

The client accepts an unrestricted base_url and places the user's OAuth token in the default headers of a persistent requests.Session. Every request made through that session therefore transmits the token to the configured URL.

The implementation does not require HTTPS, validate the destination hostname and port, or restrict the destination to the documented MXCHIP service. Consequently, a caller that controls or influences base_url can redirect authenticated requests to an attacker-operated endpoint. This is especially sensitive because the token authorizes operations against physical smart-home devices.

Attack Path

1. The victim has a valid MXCHIP_OAUTH_TOKEN in the environment or passes one to the constructor.
2. An attacker influences application configuration or supplied cod ...[truncated 1369 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the configurable endpoint if alternate MCP servers are not a supported requirement.
• If configurability is necessary, parse the URL and enforce:
  • Scheme: https
  • Hostname: app.api.cloud.mxchip.com
  • Port: 2443
  • Expected path: /mcp
• Reject embedded credentials, fragments, unexpected ports, malformed hosts, and hostname suffix tricks.
• Disable redirects or validate every redirect target before following it:

  python

  response = self.session.post(
      self.base_url,
      json=payload,
      timeout=30,
      allow_redirects=False
  )
  

• Avoid setting authorization globally on a session that might later be used for another origin. Attach the token only after validating the destination immediately before each request.
• Add tests confirming that HTTP URLs, lookalike domains, alternate ports, and cross-origin redirects are rejected.
• Support intentional custom endpoints only through an explicit high-risk option that requires separately scoped credentials.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Installation Is Not Reproducible or Integrity-Pinned

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unbounded third-party dependency version
Risk Level: Low

Vulnerable Code

text

requests>=2.28.0

Related installation guidance in SKILL.md, line 43:

bash

pip install requests

Technical Analysis

The requirement uses only a lower version bound and does not include an upper bound, exact version, lockfile, or package hashes. The documented command is even less restrictive because it installs whichever requests release the selected package index currently resolves.

This does not establish that the legitimate requests package is malicious. The weakness is that installation results can change over time without changes to the audited project. A future compromised, malicious, or behaviorally incompatible release accepted by the constraint could be installed automatically. The absence of hashes also prevents pip from verifying that the downloaded artifact is exactly the artifact reviewed and approved by the project.

Attack Path

1. A user follows the documentation and runs pip install requests, or installs from requirements.txt.
2. Pip resolves dependencies against the configured package index at installation time.
3. A future release satisfying requests>=2.28.0, or an artifact served through a compromised or untrusted package source, is selected.
4. The unreviewed package and its transitive dependencies are installed into the Skill's environment.
5. Malicious package code could execute during installation or import, or altered runtime behavior could affect credential-bearing network requests.

Exploitation depends on compromise or misuse of the dependency supply chain; no malicious dependency was confirmed in the audited package.

Impact Assessment

If dependency resolution yields malicious code, it may run with the privileges of the user or agent process that installs or imp ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions in a generated lockfile.
• Record cryptographic hashes for every accepted distribution and install with hash enforcement, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Replace the documentation's unconstrained pip install requests command with installation from the reviewed, hash-pinned dependency file.
• Use a trusted package index over TLS and avoid untrusted additional indexes.
• Run dependency vulnerability and provenance checks in CI.
• Establish a controlled update process that reviews, tests, and regenerates hashes before dependency versions change.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

md

**Get your token:**
1. Visit: https://app.api.cloud.mxchip.com:2443/oauth2/mcp/oauth
2. Enter your Smart Plus APP account credentials
3. Copy the OAuth2 access token

## Quick Start

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

**Get your token:**
1. Visit: https://app.api.cloud.mxchip.com:2443/oauth2/mcp/oauth
2. Enter your Smart Plus APP account credentials
3. Copy the OAuth2 access token

## Quick Start

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises tools that can turn devices on/off and trigger scenes but does not clearly warn that these actions change physical device state and may execute broader home automations. In a smart-home context, unclear disclosure increases the chance of unsafe or unintended operations, especially when an AI agent may invoke actions from natural-language requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README presents user invocation examples only in Chinese and names the target application with Chinese-language branding, which suggests a language-specific interaction model. Because the file does not explicitly offer alternate language support or state that the skill is intentionally limited to Chinese-speaking users for a documented regional reason, this may violate the language/locale choice policy.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises capabilities involving environment variables, MCP, and network access, but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, missing scope declarations weakens least-privilege boundaries and can allow the skill to be invoked with broader runtime capabilities than users or platform policy expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This skill enables real-world smart home actions such as powering devices, changing air conditioner settings, and triggering scenes, yet the overview does not warn that actions can affect physical devices or recommend confirmation before execution. In safety-sensitive environments, an agent could perform unintended actions that impact occupants, property, energy usage, or security posture.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The token setup instructions tell users how to obtain and export an OAuth token, but do not clearly warn at that point that the token grants access to smart home device inventory, status, and control actions. Because the token enables sensitive account and device operations, insufficient privacy and access warnings increase the chance of unsafe handling or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation describes tools that can change real-world device state (power, temperature, scene execution) but does not include user-facing safety guidance, confirmation requirements, or warnings about physical consequences. In a smart-home context, ambiguous or automatic execution could cause unsafe conditions, property damage, privacy issues, or nuisance actions such as turning devices on/off or triggering scenes without clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger_scene method directly exposes execution of arbitrary smart-home scenes, which are inherently state-changing and may unlock doors, power devices, or alter home conditions, without any built-in confirmation, policy gate, or explicit safety warning. In this skill context, the risk is elevated because the library is specifically designed for remote home automation control, so a caller can invoke impactful actions with a single method call and no second-factor validation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is specified as requests>=2.28.0, which permits installation of many different future and past-compatible versions rather than a reviewed, fixed release. This weakens build reproducibility and can allow deployment of a vulnerable or breaking version of requests, especially important here because the skill uses an OAuth token to control smart-home devices and likely makes authenticated outbound HTTP requests.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because requests is unpinned, there is no assurance that the installed version is not affected by one of the known advisories associated with that package. In this skill's context, requests is plausibly used with MXCHIP_OAUTH_TOKEN and remote device-control APIs, so a vulnerable version could increase risk of credential leakage, request tampering, or other network-layer issues depending on the resolved release.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.