Loxone

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:26 PM UTC
• Version: 1.3.3

Overview

The skill is purpose-aligned for Loxone smart-home monitoring and control, but it allows insecure credential and token handling that could expose access to a real home controller.

Install only if you will use HTTPS/WSS wherever possible, avoid use_https=false on shared or untrusted networks, use a dedicated least-privilege Loxone account, keep config.json private, and do not share terminal or agent logs from the auth test. Treat cached structure files as sensitive home-layout data and delete or protect them when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/loxone_client.py:34

Finding

HTTP Basic Credentials Can Be Transmitted Over an Unencrypted Connection

Content

View full analysis

requests.Response: url = f"{self.base_url}{endpoint}" headers = { 'Authorization': f'Basic {self.auth_header}' } try: response = requests.request( method, url, headers=headers, timeout=10, verify=self.use_https ) ``` The corresponding documented configuration is: ```json { "host": "192.168.0.222", "use_https": false } ``` ### Technical Analysis HTTP Basic authentication does not encrypt credentials. The `username:password` string is only Base64-encoded, which is trivially reversible. When `use_https` is false, both the Authorization header and subsequent smart-home API traffic are exposed to network observers. The use of `verify=self.use_https` does not compensate for this issue. With an HTTP URL, no TLS connection or certificate verification occurs at all. Network communication with the configured Loxone Miniserver is necessary for the declared functionality, so the behavior is not covert exfiltration. However, transmitting reusable credentials without encryption exceeds an acceptable minimum security baseline. ### Attack Path 1. A user configures a LAN Miniserver with `"use_ ...[truncated 1213 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/loxone_auth.py:184

Finding

Authentication Material Is Embedded in URLs and an Authenticated WebSocket URL Can Be Printed

Content

View full analysis

str: """ Get WebSocket URL with token authentication Returns: WebSocket URL with token parameter """ if not self.token: raise Exception("No token available. Run authenticate() first.") scheme = "wss" if self.protocol == "https" else "ws" return f"{scheme}://{self.host}/ws/rfc6455?token={self.token}" ``` The executable authentication test subsequently prints a prefix of the token and the complete authenticated WebSocket URL: ```python token = auth.authenticate() print(f"\n✅ Authentication successful!") print(f" Token: {token[:30]}...") print(f"\n WebSocket URL:") print(f" {auth.get_ws_url()}") ``` ### Technical Analysis Bearer tokens grant access based on possession. Putting a JWT in a query string increases the number of places where it may be retained, including terminal captures, copied diagnostics, proxy logs, URL logs, monitoring systems, and support transcripts. The `main()` path prints the entire URL returned by `get_ws_url()`, including the complete JWT. Printing the first 30 characters separately is also unnecessary secret disclosure, although the complete URL is the more serious exposure. The JWT and authentication hash are sent to the configured Miniserver as part of the Loxone pro ...[truncated 1601 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/loxone_client.py:72

Finding

Sensitive Smart-Home Topology Is Cached Without Explicitly Restrictive Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code largely matches the declared smart-home Loxone control/monitoring purpose over HTTP: it authenticates, reads structure/status, organizes rooms and controls, and sends simple commands like On/Off. However, the description explicitly claims support for 'real-time WebSocket' and 'watching live events,' but the supplied code contains only HTTP request logic and no WebSocket client, subscription, or event-stream handling. File config loading and optional JSON caching are supporting details, not mismatches. The main material description-behavior gap is the missing real-time/WebSocket capability.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 92)May include surrounding context.

Config file should be readable only by you:

bash

chmod 600 ~/Developer/Skills/loxone/config.json

Loxone Cloud DNS Setup

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares executable capabilities that imply filesystem and network access, but it does not define any explicit tool scope such as permissions or allowed-tools. In an agent environment, this can cause the skill to run with broader ambient authority than necessary, increasing the chance of unintended file access, network access, or misuse if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code explicitly notes that JWT retrieval may occur unencrypted and the implementation allows use_https=False, which means authentication material can traverse the network over plain HTTP. In a smart-home control context, interception of authentication exchanges or issued tokens could let an attacker monitor device state or send control commands to the Miniserver.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script prints the JWT token to stdout, which can expose bearer credentials in terminal scrollback, logs, CI output, shell history capture, or remote session recordings. Because this token appears to authorize WebSocket/API access to a smart-home controller, anyone who obtains it may be able to observe state or issue commands without needing the password.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code issues live control commands to devices via the Miniserver API, which can change physical or automation state. Although the docstring describes the function, there is no user-facing confirmation, warning, or visible disclosure at the point of execution that an external device state will be modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code establishes a network connection and performs authentication using the supplied username and password, sending credential-derived values over the WebSocket. Although the docstring says it authenticates, there is no user-facing prompt, warning, or explicit disclosure in the code about transmitting credentials or connecting to a remote host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The code reads a configuration file and extracts username and password for authentication, but provides no visible warning or disclosure to the user that sensitive credentials are being loaded and used. In this file, the docstrings mention the parameters but do not clearly warn at the usage point about secret handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script creates a .cache directory and writes LoxAPP3.json to disk via fetch_structure, which stores device structure data locally. While this supports the tool's functionality, there is no explicit user-facing warning in the CLI help or runtime output that local files will be created and reused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.