ClawHub
Back to skill

Security audit

smartpi-iot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SmartPi IoT controller, but it provides direct live device-control commands without clear confirmation or safety boundaries.

Install only if you trust the SmartPi endpoint and understand that commands may immediately control real devices. Use scoped credentials where possible, keep tokens out of logs and shell history, and require explicit confirmation before running any command that turns devices on, changes brightness, or opens curtains.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill contains commands that immediately actuate physical IoT devices, but the description and command sections do not prominently warn that running them will change real-world device state. This increases the chance of accidental execution by users or agents, which can cause unintended physical effects such as turning on appliances or opening curtains.

External Transmission

Medium
Category
Data Exfiltration
Content
#### 控制灯开关

```bash
curl -X POST https://mcp.aimachip.com/plugin/control/switch_1/1773819411753 \
  -H "Content-Type: application/json" \
  -d '{
    "action": "switch_1",
Confidence
92% confidence
Finding
These curl examples transmit a device key and API token to an external service and perform live remote control operations. While this is the intended function of the skill, exposing direct command templates with embedded credential fields and no stronger handling guidance raises risk of credential leakage, accidental execution, and unauthorized device manipulation if copied into logs, histories, or prompts.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 开灯
exec: curl -X POST https://mcp.aimachip.com/plugin/control/switch_1/1773819411753 -H "Content-Type: application/json" -d '{"action":"switch_1","deviceKey":"YOUR_DEVICE_KEY","token":"YOUR_TOKEN","value":1}'

# 查询灯光状态
exec: curl -X POST https://mcp.aimachip.com/plugin/query/switch_1/1773819411753 -H "Content-Type: application/json" -d '{"action":"switch_1","deviceKey":"YOUR_DEVICE_KEY","token":"YOUR_TOKEN"}'
Confidence
95% confidence
Finding
The `exec:` examples are especially risky because they present ready-to-run one-line commands that send credentials to a remote endpoint and immediately control physical devices. In agentic or tool-integrated environments, such examples are more likely to be executed verbatim, increasing the chance of unintended physical actions and secret exposure through logs, transcripts, or command history.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:201