RootONLocal-LocalWeb-ControlV2.0.4

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 2.0.4

Overview

This skill is openly designed to control local smart-home devices, but it exposes reusable IoT credentials and weakens transport/authentication protections enough that users should review it carefully before installing.

Install only if you understand that the skill can read local smart-home credentials, enumerate devices and rooms, and send commands that change real devices. Prefer using it only on a trusted machine and network, avoid HTTP or certificate-bypass configurations, restrict local API/CORS access if possible, and consider requiring explicit confirmation for HVAC, plugs, blinds, and IR power toggles.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: api-spec.md:3

Finding

Unauthenticated Loopback API Exposes Reusable IoT Credentials with Wildcard CORS

Content

View full analysis

/iot/info returns the LocalWeb account and password in plaintext. > If this server becomes externally accessible, the credentials will be exposed. --- ## Common Response Headers HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: * Cache-Control: no-store ``` The `/iot/info` response is further documented as returning the reusable `user` and `password` values needed to authenticate directly to each Smart Station. ### Technical Analysis The service treats loopback binding as an authentication boundary, but binding to `127.0.0.1` only prevents direct connections from remote network hosts. It does not protect the service from: - Other processes running under the same host. - Compromised desktop applications, browser extensions, or local malware. - Sandboxed or lower-trust applications that retain loopback network access. - Browser content capable of issuing and reading localhost requests, subject to the browser's Private Network Access and mixed-content controls. The wildcard `Access-Control-Allow-Origin: *` policy increases browser-based exposure by allowing responses to be shared with any origin whenever the browser permits the request. Because `/iot/info` returns a reusable account and password without requiring authentication, any process that can connect to the loopback port can obtain credentials without first proving that it is the authorized Skill host. Th ...[truncated 2495 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: localweb-spec.md:14

Finding

Reusable Credentials May Be Sent over Plain HTTP or to an Unverified TLS Peer

Content

View full analysis

scheme="https", port=8080 - useHttps=false -> scheme="http", port=8008 - station_ip: IP from the GET /iot/station response - endpoint: For example, api.EpGet, api.EpSet, api.EpGetAll, api.EpGetAgtState > HTTPS certificates may be self-signed. It is recommended that OpenClaw bypass > certificate verification only for private IP addresses > (192.168.x.x / 10.x / 172.16-31.x). --- ## 2. Common Request Format - Method: POST - Content-Type: application/json - Body — all five fields below must be included. { "id": 1, "user": "", "password": "", "method": "", "params": { ... } } ``` ### Technical Analysis When `useHttps=false`, the Skill sends the reusable LocalWeb username, password, device identifier, and requested operation over unencrypted HTTP. Any party able to observe or manipulate local network traffic can read or alter those values. When HTTPS is enabled, bypassing certificate verification prevents the client from authenticating the Smart Station. Restricting the bypass to RFC1918 private IP addresses does not make it safe: an attacker-controlled host can also use a private address, and a local network attacker can redirect traffic for an expected station address through ARP spoofing, routing manipulation, or another network-positioning technique. Because every request includes the reusable password rather than a short-lived session token, interception of a single request may provide continued access. A man-in-the-middle can also modify an apparently legitimate command—for example, changing its device identifier, channel, operation, or value—or return a forged success response. The f ...[truncated 2423 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

| `SKILL.md` | (이 파일) 스킬 사용 개요 — OpenClaw 에 그대로 등록한다. |

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples explicitly instruct retrieval of plaintext credentials from a local endpoint and reuse of those values in subsequent requests, normalizing direct handling of secrets in clear form. In skill ecosystems, this becomes dangerous if the agent logs prompts, tool inputs/outputs, traces, or error payloads, because the station username/password can be exposed and then used to control local IoT devices.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The pseudocode returns the full device object plus request and result payloads after execution, which can leak station IPs, device identifiers, detailed topology, and potentially sensitive API responses. In agent runtimes, such return values are often surfaced to the model, conversation history, telemetry, or logs, creating an unnecessary data-exposure channel that can aid further compromise or privacy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation explicitly recommends bypassing HTTPS certificate validation for private IP ranges, which defeats the core authentication property of TLS and enables man-in-the-middle interception or modification by any attacker with local network position. In this skill, intercepted traffic includes reusable credentials and device-control commands, making the issue especially dangerous because an attacker can both steal secrets and alter smart-home actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill can directly issue EpSet commands to local IoT devices, including lights, blinds, switches, and air conditioning, but the documentation section identified by the finding does not prominently warn users that natural-language requests may trigger real physical state changes. This increases the risk of unintended or misunderstood commands causing physical actions, especially because the skill automatically resolves devices and sends control requests to a local station API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The spec explicitly exposes LocalWeb credentials in plaintext via GET /iot/info and permits Access-Control-Allow-Origin: * on a localhost service with no authentication. In practice, any web page, WebView content, browser extension, or local process running on the same device may be able to read the endpoint and then use the returned credentials to control IoT devices or harvest device/network metadata. The skill context makes this more dangerous because the returned data is immediately sufficient to access and manipulate LifeSmart stations on the local network.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly states that IR power commands may be toggle-only and that current state cannot be known, yet it only says warning the user is 'recommended' rather than mandatory. In a home automation skill, ambiguous power control can cause unintended actuation of HVAC or other appliances, which can create safety, availability, and trust issues when the agent claims to perform a deterministic on/off action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's natural-language invocation guidance enumerates only Korean keywords for user command matching. That effectively biases the skill toward a specific language/locale without stating that it is Korea-specific or offering multilingual/user-opt-in behavior.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown instructs the skill to retrieve user and password from /iot/info and use them in subsequent LocalWeb requests. Because the document describes access to sensitive credentials and authenticated device-control operations, it should explicitly warn users that the skill reads and transmits local IoT credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples show direct control of lights, air conditioners, blinds, plugs, and IR remotes via EpSet and related APIs, which can affect user environment and connected devices. The file provides operational details but does not include a general user-facing warning that these actions may modify real device state or should be confirmed for potentially sensitive actions.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · examples.md (reported line 332)May include surrounding context.

ts

async function executeCommand(utterance: string) {
  const info = await fetch('http://127.0.0.1:18080/iot/info').then(r => r.json());
  if (!info.enabled) return { ok:false, error:'localweb_disabled' };

  const [stations, groups, dash, gdev] = await Promise.all([

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · examples.md (reported line 336)May include surrounding context.

ts

async function executeCommand(utterance: string) {
  const info = await fetch('http://127.0.0.1:18080/iot/info').then(r => r.json());
  if (!info.enabled) return { ok:false, error:'localweb_disabled' };

  const [stations, groups, dash, gdev] = await Promise.all([

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · examples.md (reported line 337)May include surrounding context.

ts

async function executeCommand(utterance: string) {
  const info = await fetch('http://127.0.0.1:18080/iot/info').then(r => r.json());
  if (!info.enabled) return { ok:false, error:'localweb_disabled' };

  const [stations, groups, dash, gdev] = await Promise.all([

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · examples.md (reported line 338)May include surrounding context.

ts

async function executeCommand(utterance: string) {
  const info = await fetch('http://127.0.0.1:18080/iot/info').then(r => r.json());
  if (!info.enabled) return { ok:false, error:'localweb_disabled' };

  const [stations, groups, dash, gdev] = await Promise.all([

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · examples.md (reported line 339)May include surrounding context.

ts

async function executeCommand(utterance: string) {
  const info = await fetch('http://127.0.0.1:18080/iot/info').then(r => r.json());
  if (!info.enabled) return { ok:false, error:'localweb_disabled' };

  const [stations, groups, dash, gdev] = await Promise.all([

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The spec requires sending the LocalWeb username and password in every request, which increases the chance of credential exposure through logs, debugging output, memory dumps, proxy capture, or interception on the local network. In this skill's context, those credentials directly enable control of local IoT devices, so compromise can lead to unauthorized device manipulation and persistent access until credentials rotate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language instructions and usage guidance are presented in Korean, and the examples and interaction model assume Korean-language operation. There is no statement that this language restriction is optional, user-selected, or justified as a region-specific skill, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language content and field descriptions are written in Korean, and type_label is explicitly described as a Korean-friendly label (사용자 친화 한글명). The file does not indicate that the skill is Korea-specific or that users may choose another language/locale, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation and inline comment state that station IP is already present on device records and that /iot/station does not need to be queried. However, the pseudocode still includes a fetch to http://127.0.0.1:18080/iot/station in Promise.all, creating a direct contradiction between the documented intent and the shown behavior.

Content

No source excerpt is available for this finding.