ClawHub
Back to skill

Security audit

Wyze Scale

Security checks for vulnerabilities and agentic risk

Overview

The skill transparently reads Wyze smart-scale body metrics, but users should treat its credentials, token cache, and unpinned npm dependency with care.

Install only if you are comfortable giving this skill access to your Wyze API credentials, cached Wyze login, household member identifiers, and body-composition records. Prefer pinning wyze-node with a lockfile before use, keep WYZE_ENV and token files private, and use the skill only in private sessions where the scale user's health data should be visible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:5
Finding

Unpinned Third-Party Runtime Dependency Without Lockfile Integrity

Content
View full analysis

Vulnerability Details

File Location: scripts/package.json:5-7
Additional Location: SKILL.md:25
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

Vulnerable Code

scripts/package.json:5-7:

json
"dependencies": {
  "wyze-node": "^2.12.2"
}

SKILL.md:25:

text
npm install --prefix "{baseDir}/scripts" wyze-node

Technical Analysis

The runtime dependency uses the semver range ^2.12.2, while the documented installation command does not specify an exact version. The project also contains no package lockfile or other integrity record. Consequently, separate installations can resolve to different package versions from the public npm registry.

This dependency is loaded and executed by scripts/scale, where it receives Wyze account identifiers and API credentials and performs authenticated API operations. If an allowed future release or its publishing infrastructure is compromised, attacker-controlled package initialization code would execute with the same operating-system permissions as the skill.

This finding does not establish that the current wyze-node release is malicious. The risk arises from mutable, non-reproducible dependency resolution for a security-sensitive component.

Attack Path

  1. An attacker compromises the wyze-node npm publisher account, package distribution channel, or a future version accepted by ^2.12.2.
  2. The attacker publishes a malicious release within the permitted semantic-version range.
  3. A user follows the setup documentation or performs a fresh dependency installation.
  4. npm resolves and installs the malicious release because no exact lockfile and integrity-controlled installation process is present.
  5. scripts/scale imports wyze-node using require('wyze-node').
  6. Malicious package code executes in the skill process and can access environment variables, the configured credenti ...[truncated 710 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin wyze-node to a reviewed exact version rather than a semver range:
    json
    "dependencies": {
  "wyze-node": "2.12.2"
}
  2. Generate and commit package-lock.json so package versions and registry integrity hashes are reproducible and reviewable.
  3. Replace ad hoc installation guidance with npm ci --prefix "{baseDir}/scripts" so installation fails when the manifest and lockfile disagree.
  4. Review dependency provenance, maintainers, release history, transitive dependencies, and npm integrity metadata before upgrades.
  5. Use a controlled dependency-update process that audits and tests each new version before modifying the lockfile.
  6. Run the skill with least privilege and restrict its filesystem and network access where practical, reducing the impact of a compromised package.
  7. Avoid exposing credentials to the process longer than necessary and ensure credential and token files have owner-only permissions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs use of sensitive environment-backed secrets (WYZE_EMAIL, WYZE_KEY_ID, WYZE_API_KEY, token cache paths) but does not declare an explicit tool scope or permissions model. That omission weakens least-privilege controls and can let an agent access environment data implicitly, which is especially concerning here because the skill handles authentication material and sensitive health data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code retrieves health-related data from a smart scale account and prints detailed body metrics and family-member-associated records, but it provides no warning, confirmation, or privacy disclosure to the user before doing so. The header comment references SKILL.md for configuration, but in this file there is no user-facing notice that the command accesses potentially sensitive personal health data.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency is version-ranged with a caret (^2.12.2), which allows newer compatible releases to be installed over time. This creates supply-chain risk because builds are not fully reproducible and a compromised or buggy upstream release of wyze-node could be pulled in without an intentional review, which is more sensitive here because the skill accesses household body metrics through an unofficial API library.

Content

Scanner excerpt · scripts/package.json (reported line 6)May include surrounding context.

json
"private": true,
  "description": "Runtime dependency for the Wyze scale OpenClaw skill",
  "dependencies": {
    "wyze-node": "^2.12.2"
  }
}

Static analysis

No suspicious patterns detected.