mxchip-smart-control

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:31 AM UTC
• Version: 1.0.2

Overview

This smart-home control skill is coherent and not deceptive, but it needs review because it can immediately control physical devices and its token-bearing client accepts an unvalidated endpoint override.

Install only if you trust the MXCHIP service and are comfortable giving the agent control over your Smart Plus devices and scenes. Require explicit confirmation before turning devices on or off, changing air-conditioner settings, or triggering scenes; keep MXCHIP_OAUTH_TOKEN secret; avoid custom base_url values unless validated as the official MXCHIP endpoint; and prefer a pinned dependency set.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mxchip_mcp_client.py:61

Finding

OAuth Bearer Token Can Be Sent to a Caller-Controlled Endpoint

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Produces Non-Reproducible Installations

Content

View full analysis

=2.28.0 ``` `SKILL.md`: ```bash pip install requests ``` `README.md`: ```bash pip install requests ``` ### Technical Analysis The dependency declaration specifies only a minimum version, while the installation instructions do not specify a version at all. As a result, installations performed at different times can resolve to different releases without any source change or security review. No lockfile or package hashes are provided to verify the exact artifact installed. This creates a non-reproducible dependency chain for a client that handles an OAuth token and authenticated smart-home control traffic. The package name `requests` is conventional, and the reviewed files do not contain evidence that the project intentionally installs a malicious or typosquatted package. The risk arises from automatically accepting future versions and from the absence of artifact integrity controls. ### Attack Path 1. A future dependency version permitted by `requests>=2.28.0` is compromised, maliciously replaced at its distribution source, or introduces a security regression. 2. A user installs the project using `pip install -r requirements.txt` or the documented `pip install requests` command. 3. Package resolution selects the affected release because no exact version or trusted hash is required. 4. The dependency is imported into the same Python process as the MCP client. 5. Compromised dependency code can execute with the privileges of that process and may inspect or alter token-bearing requests. This path depends on an upstream package or distribution compromise, or on a vulnerable future release; no active dependency compromise was ...[truncated 742 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

md

**Get your token:**
1. Visit: https://app.api.cloud.mxchip.com:2443/oauth2/mcp/oauth
2. Enter your Smart Plus APP account credentials
3. Copy the OAuth2 access token

## Quick Start

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

**Get your token:**
1. Visit: https://app.api.cloud.mxchip.com:2443/oauth2/mcp/oauth
2. Enter your Smart Plus APP account credentials
3. Copy the OAuth2 access token

## Quick Start

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes tools that can remotely power devices, change air conditioner settings, and trigger scenes, but it does not warn users or integrators about real-world consequences, confirmation requirements, or target verification before execution. In a smart-home context, ambiguous or mistaken commands can cause unauthorized actuation, safety issues, privacy impact, or operational disruption in the physical environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill exposes environment-variable access, network access, and MCP-based device control but does not declare any tool scope or allowed-tools restrictions. In an agent ecosystem, this weakens policy enforcement and can allow broader-than-expected access to credentials and physical-device control, increasing the chance of unauthorized or accidental actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The overview emphasizes complete smart-home control and scene automation but does not clearly warn that commands can immediately affect physical devices or trigger multi-device routines. In a smart-home context, lack of safety disclosure can lead to unsafe agent behavior, unexpected actuation, or triggering of sensitive scenes such as leaving-home or HVAC changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The token setup instructions describe obtaining and exporting an OAuth token but do not warn that the token grants network access to the user's smart-home account, device inventory, and automation controls. This omission can cause users or agents to mishandle a credential that enables both privacy exposure and remote physical control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This documentation enables actions that affect real-world devices in a user's home, including powering devices, adjusting HVAC settings, and triggering scenes, but it does not warn about physical-world consequences or require confirmation for potentially impactful actions. In an agent context, that omission can normalize autonomous execution of commands that may affect safety, comfort, privacy, energy use, or property without adequate user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The client exposes direct methods to power devices, change HVAC settings, and trigger scenes, and those actions are sent immediately to the remote service with no built-in confirmation, preview, or safety interlock. In an agent setting, this increases the chance of unintended or prompt-induced real-world actions affecting the user's home, especially because scenes may bundle multiple device operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The natural-language invocation examples and scene names are exclusively Chinese, which can imply a language-specific interaction model. Because the README does not explicitly state that the skill is China/Chinese-only or offer language alternatives, this may conflict with a policy requiring language choice or opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.28.0, which allows any future major or minor release and makes builds non-reproducible. This can introduce vulnerable or breaking versions unexpectedly, and in a smart-home control skill that uses OAuth tokens and remote API calls, dependency drift could affect request handling or credential safety.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Because requests is not pinned, it is impossible to verify from this manifest whether deployment will use a version affected by known advisories. In this skill's context, the library will likely be used for authenticated calls to Smart Plus APIs, so an affected version could expose tokens, mishandle TLS/session behavior, or otherwise weaken outbound request security.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.