ClawHub
Back to skill

Security audit

Wyze Vacuum

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it lets a user check and control a Wyze robot vacuum, with disclosed use of Wyze credentials and tokens.

Before installing, understand that this skill can use your Wyze API credentials and cached login to control a physical vacuum. Review the npm dependency, prefer a pinned version or lockfile, and only allow state-changing commands like start, pause, or dock when you explicitly ask for them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:5
Finding

Unpinned Third-Party Dependency Allows Unreviewed Supply-Chain Changes

Content
View full analysis

Vulnerability Details

File Location: scripts/package.json:5-6; related installation instruction at SKILL.md:24
Vulnerability Type: Unpinned npm dependency and missing lockfile
Risk Level: Medium

Vulnerable Code

scripts/package.json:5-6:

json
"dependencies": {
  "wyze-node": "^2.12.2"
}

SKILL.md:24:

text
1. `npm install --prefix "{baseDir}/scripts" wyze-node`

Technical Analysis

The package manifest permits npm to resolve any compatible wyze-node release under the caret range rather than an exact audited version. The documented setup command is even less restrictive because it installs wyze-node without specifying any version. The project also contains no package lockfile that pins the complete transitive dependency graph and associated integrity hashes.

Consequently, following the documented installation procedure can retrieve package contents that differ from those reviewed during this audit. npm packages and their transitive dependencies may execute lifecycle scripts during installation, while the installed wyze-node package is later loaded directly by scripts/vacuum. A compromised maintainer account, malicious compatible release, or compromised transitive dependency could therefore introduce arbitrary code without requiring changes to this repository.

Attack Path

  1. An attacker compromises the wyze-node publishing account, an allowed transitive dependency, or another component selected by npm dependency resolution.
  2. The attacker publishes a malicious release compatible with ^2.12.2, or a release selected by the unversioned command in SKILL.md.
  3. A user follows the setup instructions and runs npm install --prefix "{baseDir}/scripts" wyze-node.
  4. npm downloads the changed dependency graph and may execute malicious package lifecycle scripts with the user's permissions.
  5. Alternatively, the malicious package executes when scripts/vacuum l ...[truncated 795 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the caret range with an exact, reviewed dependency version, for example:
    json
    "wyze-node": "2.12.2"
  2. Generate and commit scripts/package-lock.json so that all transitive versions and integrity hashes are fixed.
  3. Change the documented installation process to use the committed manifest and lockfile:
    bash
    npm ci --prefix "{baseDir}/scripts"
  4. Do not instruct users to install wyze-node without an explicit version.
  5. Review dependency lifecycle scripts and the transitive dependency tree before accepting upgrades.
  6. Use automated dependency scanning and require manual review for lockfile changes.
  7. Where operationally feasible, disable installation scripts with --ignore-scripts after confirming that the audited dependency does not require them.
  8. Run the skill under a least-privileged account and restrict permissions on the Wyze environment file and token directory.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "wyze-vacuum"
description: "Check and control a Wyze robot vacuum — status (battery, docked/cleaning), start, pause, and send to dock. Unofficial Wyze API via wyze-node."
homepage: "https://github.com/noelportugal/wyze-node"
metadata:
  openclaw:
    emoji: "🤖"
    requires: { bins: ["node"] }
---

# Wyze vacuum

Check and control a Wyze **robot vacuum** through the bundled `vacuum` CLI,
which wraps [`wyze-node`](https://www.npmjs.com/package/wyze-node). Reuses the
same cached login as the `wyze` skill (no password).

> Unofficial: `wyze-node` uses Wyze's developer API Key auth and
> reverse-engineered

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents use of environment-based secrets (WYZE_EMAIL, WYZE_KEY_ID, WYZE_API_KEY, WYZE_ENV) and cached authentication, but it does not declare any explicit tool scope or permissions metadata. That creates an authorization and review gap: an agent may access sensitive env-backed credentials and perform real-world device control without a manifest-level restriction boundary.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a caret range (^2.12.2), which allows newer compatible versions to be installed automatically. This creates a supply-chain risk: a future compromised or vulnerable release of wyze-node could be pulled in without review, changing runtime behavior in a skill that can control a physical device and likely handles Wyze account access.

Content

Scanner excerpt · scripts/package.json (reported line 6)May include surrounding context.

json
"private": true,
  "description": "Runtime dependency for the Wyze vacuum OpenClaw skill",
  "dependencies": {
    "wyze-node": "^2.12.2"
  }
}

Static analysis

No suspicious patterns detected.