Smart Home Unified

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:42 AM UTC
• Version: 1.1.0

Overview

This smart-home skill is purpose-related but needs Review because it asks users to store high-value smart-home and account credentials in plaintext while making unsupported security and capability claims.

Install only after treating this as a prototype: do not put Xiaomi, Apple, HomeKit, or device secrets in TOOLS.md; avoid paid plans or relying on advertised automation until the publisher documents implemented features, secure secret storage, privacy practices, and exact supported devices. Review the code and dependency versions before connecting real devices.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:38

Finding

Plaintext and Unnecessary Collection of High-Value Smart-Home Credentials

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package.json:25

Finding

Unpinned and Redundantly Installed Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

other

Error

• Location: README.md:1

Finding

False Security and Capability Claims Encourage Unsafe Credential Disclosure and Payment

Content

View full analysis

', '按平台筛选') .option('--room ', '按房间筛选') .option('--info ', '查看设备详情') .option('--refresh', '刷新设备状态') .action(async (options) => { if (options.list) { console.log(chalk.blue('📱 加载设备列表...')); // TODO: 实现设备列表 console.log('客厅主灯 - 小米 - 在线'); console.log('空调 - 华为 - 在线'); console.log('窗帘 - HomeKit - 离线'); } }); ``` Scene execution is also a placeholder: ```javascript program .command('scene [name]') .description('执行或管理场景') .action((action, name) => { if (action === 'run' && name) { console.log(chalk.green(`🎬 执行场景：${name}`)); // TODO: 实现场景执行 } }); ``` The testing document identifies the advertised integrations and paid features as future work: ```markdown ## 下一步 1. 实现各平台真实 API 对接 2. 添加场景编辑器 3. 实现 AI 节能算法 4. 开发手机 App ``` Additional inconsistencies include package version `1.0.0`, ClawHub metadata version `1.0.2`, and a README claim for version `1.1.0`. Metadata advertises seven platforms, while the repository contains only two adapters ...[truncated 2276 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The marketing copy explicitly reassures users that credentials are encrypted locally while promoting integration across multiple platforms, but it does not explain what credentials are collected, how they are handled, or what telemetry may accompany use of the product. In a smart-home context, platform credentials can grant broad access to devices, routines, and occupancy-related data, so omission of clear privacy and data-handling disclosures can mislead users into sharing sensitive access without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tracking plan documents use of ClawHub backend data, Google Analytics, coupon tracking, and user feedback collection, but nowhere indicates that users will be informed or given consent choices regarding telemetry and monitoring. Because this product manages smart-home usage, analytics can reveal behavior patterns, device ownership, and occupancy habits, making undisclosed tracking a meaningful privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document advertises AI analysis of household electricity habits and automatic shutdown/control of devices without warning users that this requires behavior profiling and may trigger system-impacting automation. In a smart-home environment, such automation can affect HVAC, heating, and other essential devices, creating privacy concerns and potential safety or availability issues if actions are wrong or unexpected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The report promotes security monitoring features such as door/window sensors, camera anomaly detection, and gas/water leak alerts without any visible warning about what data is collected, how long it is retained, who can access it, or the consequences of false positives and remote notifications. In a smart-home context, these capabilities can expose highly sensitive occupancy and household-behavior data, so omitting privacy and operational warnings is a real user-safety and privacy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs users to authenticate with an API token on the command line but does not warn that passing secrets as CLI arguments can expose them through shell history, process listings, logs, or CI output. In a quick-start guide for publishing a skill, this omission increases the chance that users mishandle credentials during routine deployment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation is written entirely in Chinese, including headings, instructions, and safety guidance, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, mandating a specific language without opt-in or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly instructs users to place highly sensitive credentials such as Xiaomi account usernames/passwords, device tokens, HomeKit PINs, and optionally Apple ID credentials into TOOLS.md, which is typically a plaintext documentation/configuration file. Storing these secrets in an easily readable file materially increases the risk of credential theft, accidental commit to version control, lateral access to smart home devices, and possible compromise of linked cloud accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs users to authenticate with an API token via a shell command but does not warn that embedding secrets directly in command lines can expose them through shell history, process listings, screenshots, logs, or shared terminals. Because this is a publishing/authentication workflow, users are likely to copy-paste the example verbatim, increasing the chance of credential leakage and subsequent account compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document includes a command that executes a home-automation scene ("scene run "回家模式"") and shows successful state changes to physical devices without any safety warning, confirmation step, or indication that this affects real hardware. In a smart-home context, triggering lights, HVAC, or curtains can have real-world consequences, especially if copied into a live environment by a user who assumes it is a harmless test.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest description is entirely in Chinese and provides no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description is written entirely in Chinese and presents the skill in a single language with no indication that other languages or locales are supported. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The header comment states this is a HomeKit platform adapter with real API integration, but the core behavior does not perform actual device discovery, state reads, or characteristic writes. The documented intent is contradicted by comments and code in the implementation, especially where control and status functions explicitly say they are simplified placeholders.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This JavaScript file contains comments, errors, and console messages entirely in Chinese, including operational guidance and failure messages. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the skill is clearly documented as region-specific, which is not shown here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring and log messages present connect() as successfully connecting to HomeKit and discovering accessories, yet the method only validates that a PIN exists and then prints success messages. No code uses hap-nodejs APIs to pair, connect, or populate this.accessories, so the stated behavior is contradicted by the implementation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The public control() method is documented and structured as if it performs real device actions such as turnOn and setBrightness. However, _setCharacteristic() explicitly notes that it is a simplified implementation and only logs the requested change before returning success, which contradicts the apparent intent of real control.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This JavaScript file contains natural-language comments and console messages entirely in Chinese, including setup guidance and runtime status output. Because the file does not indicate that the skill is intentionally China/Chinese-only or provide any language opt-in, it violates the language/locale policy for natural-language content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring and log messages describe account login ("登录小米账号" / "小米账号登录成功"), which implies authenticating with Xiaomi cloud credentials. However, the code only checks that username and password are present, then calls miio.device({ address, token }) to connect to a local device and does not use this.username or this.password in any authentication flow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The report content is predominantly in Chinese while also targeting international channels and users, but it does not indicate that users can choose their preferred language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill guidance is presented entirely in Chinese, including headings and operational instructions, with no indication that this language choice is optional, user-selected, or intended for a specific locale. The policy requires flagging language or locale constraints when a specific language is effectively forced without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

All headings, instructions, and warnings are presented in Chinese, and the document does not provide an alternative language option or state that the skill is intended only for a Chinese-speaking region. This can violate language/locale policy when users are not given an opt-in or locale-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The user-facing description string forces a specific language/locale in natural-language output. Under the policy, locale constraints should either offer user choice or be clearly documented as intentionally region-specific; this file does neither.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

Using caret ranges for dependencies allows newer releases to be installed without explicit review, which weakens build reproducibility and can unexpectedly introduce vulnerable or malicious upstream versions. In a CLI that controls smart-home and IoT devices, dependency compromise could affect local credentials, device control flows, or network requests.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"author": "lvjunjie-byte",
  "license": "MIT-0",
  "dependencies": {
    "commander": "^11.0.0",
    "axios": "^1.6.0",
    "chalk": "^5.3.0",
    "ora": "^7.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The unpinned axios dependency permits semver-compatible updates to be resolved at install time, reducing supply-chain integrity and making it harder to verify whether a safe version is actually installed. Because axios is commonly used for outbound HTTP requests, compromise or regression here could affect authentication material, API traffic, or remote command flows.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"license": "MIT-0",
  "dependencies": {
    "commander": "^11.0.0",
    "axios": "^1.6.0",
    "chalk": "^5.3.0",
    "ora": "^7.0.0",
    "inquirer": "^9.2.0",

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest references axios with a non-exact version while the package family has multiple known advisories, making it impossible to verify from this file whether a vulnerable release will be installed. Given axios' central role in HTTP communication, an affected version could expose requests, credentials, or enable SSRF-like behavior depending on usage in the CLI.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

An unpinned chalk dependency introduces unnecessary supply-chain risk because future package resolution may pull in different code than was originally tested. While chalk is typically low-privilege formatting code, the npm execution and import model means a malicious package version could still execute in the CLI context.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"dependencies": {
    "commander": "^11.0.0",
    "axios": "^1.6.0",
    "chalk": "^5.3.0",
    "ora": "^7.0.0",
    "inquirer": "^9.2.0",
    "yaml": "^2.3.0",

Static analysis

No suspicious patterns detected.