Unifi

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:27 PM UTC
• Version: 3.2.1

Overview

This skill appears purpose-aligned for UniFi administration, but it can immediately change live network settings without confirmation or rollback safeguards.

Review this before installing if an agent may run commands on your production UniFi network. Use least-privilege UniFi API keys, configure the local gateway certificate fingerprint, install dependencies in an isolated environment, and treat set-wlan, set-network-dns, set-radio, set-client, and label-client as live changes that can affect connectivity immediately.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SETUP.md:6

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SETUP.md:6
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code

text

- `requests` library (`pip install requests`)

Technical Analysis

The setup instructions install requests without a fixed version, cryptographic hash, lockfile, or explicitly trusted package index. Consequently, the installed artifact can vary over time and depends on the package source configured in the user's environment.

This does not establish that the legitimate requests package is malicious. The risk is that a compromised package release, compromised or misconfigured package index, or substituted package source could provide altered code. Python package installation and import can execute package-controlled code. In this Skill, such code would run in a process that may have access to UNIFI_API_KEY, UNIFI_LOCAL_API_KEY, and network-management access.

Attack Path

1. An attacker compromises the configured Python package source, a relevant package release, or the user's package-index configuration.
2. The user follows SETUP.md and executes pip install requests.
3. Because the command specifies neither a reviewed version nor a required hash, the attacker-controlled artifact is accepted.
4. Malicious package code runs during installation or when scripts/unifi.py imports requests.
5. The code may read process environment variables and files available to the user, including UniFi credentials, and transmit them or perform actions with the user's privileges.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user performing installation or running the Skill. The resulting scope may include:

• Access to the Skill process's environment variables.
• Theft of cloud or local UniFi API credentials.
• Unauthorized access to UniFi infrastructure within the permi ...[truncated 447 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dependency file containing an explicitly reviewed version, for example:

   text

   requests==<reviewed-version>
   

2. Record cryptographic hashes and require their verification:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate and commit a lockfile using a suitable dependency-management tool.

4. Document the trusted package index and avoid inheriting untrusted PIP_INDEX_URL or PIP_EXTRA_INDEX_URL settings.

5. Install dependencies in an isolated virtual environment under a non-privileged account.

6. Periodically update the pinned version and hashes after security review rather than installing an unconstrained latest release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'headers' from os.environ.get (line 120, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/unifi.py (reported line 82)May include surrounding context.

python

}

    try:
        resp = requests.get(url, headers=headers, timeout=15)
        if not resp.ok:
            _handle_api_error(resp, url)
        return resp.json()

Tainted flow: 'headers' from os.environ.get (line 120, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/unifi.py (reported line 224)May include surrounding context.

python

"Accept": "application/json",
    }
    try:
        resp = requests.get(url, headers=headers, timeout=30)
        if not resp.ok:
            _handle_api_error(resp, url)
        return resp.json()

Tainted flow: 'headers' from os.environ.get (line 120, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/unifi.py (reported line 249)May include surrounding context.

python

"Accept": "application/json",
    }
    try:
        resp = requests.get(url, headers=headers, timeout=30)
        if not resp.ok:
            _handle_api_error(resp, url)
        return resp.json()

Tainted flow: 'headers' from os.environ.get (line 120, credential/environment) → requests.put (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/unifi.py (reported line 247)May include surrounding context.

python

try:
        if method == "PUT" and payload is not None:
            headers["Content-Type"] = "application/json"
            resp = requests.put(url, headers=headers, json=payload, timeout=30)
        else:
            resp = requests.get(url, headers=headers, timeout=30)
        if not resp.ok:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The network DNS update command can change DHCP-advertised DNS settings for an entire network without confirmation, blast-radius warnings, or preflight validation. Misconfiguration here can disrupt name resolution for many devices at once, causing broad service outages or redirecting traffic if malicious DNS values are entered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly states that local HTTPS requests proceed without certificate verification when no fingerprint is configured. That enables man-in-the-middle interception on local network connections, which is especially relevant for a network-management skill that handles API keys and can perform administrative actions against UniFi infrastructure. The note explains pinning but does not clearly warn users that the fallback mode is insecure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes capabilities that can read environment variables, access files, and communicate over the network, but it does not declare any explicit tool scope such as permissions or allowed-tools. In a skill that manages live network infrastructure, this ambiguity weakens enforcement and review, making it easier for the skill to access secrets or perform network actions beyond what users may expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents commands that can modify WLAN, DNS, radio, and client configuration on production UniFi infrastructure, but it does not clearly warn that these are live, state-changing operations. In this context, an agent or user could invoke destructive or disruptive commands without understanding they will immediately alter network behavior, potentially causing outages, lockouts, or degraded connectivity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code makes authenticated HTTP requests to the UniFi cloud API and multiple commands later retrieve client, device, event, and site data through those requests. Although the script has docstrings and command help text, it does not clearly warn users that invoking these commands may transmit network inventory and client-identifying data to cloud or connector services.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The code disables CA verification globally on the local HTTPS session via verify=False and relies solely on fingerprint assertion in a custom adapter. While fingerprint pinning can be strong when implemented correctly, disabling standard certificate validation weakens defense in depth and may create unsafe behavior if the adapter is bypassed, changed, or incompletely applied in future modifications.

Content

Scanner excerpt · scripts/unifi.py (reported line 194)May include surrounding context.

python

_local_session.mount("https://", _FingerprintAdapter())
        # CA verification is replaced by fingerprint assertion at the TLS level;
        # disable the default CA check to avoid rejecting self-signed certs.
        _local_session.verify = False

    return _local_session, base

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/unifi.py (reported line 247)May include surrounding context.

python

try:
        if method == "PUT" and payload is not None:
            headers["Content-Type"] = "application/json"
            resp = requests.put(url, headers=headers, json=payload, timeout=30)
        else:
            resp = requests.get(url, headers=headers, timeout=30)
        if not resp.ok:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Configuration-changing WLAN commands execute immediately without any confirmation, dry-run mode, or explicit warning about service disruption. In a network-management skill, accidental invocation or parameter mistakes can weaken wireless security or interrupt connectivity across many clients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Radio settings are pushed directly to APs without confirmation or rollback safeguards, and mistakes in channel, width, or power can immediately degrade coverage or disconnect wireless users. Because this skill manages production network infrastructure, unsafe UX around write operations materially increases the chance of operator-induced outages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Client configuration updates alter naming, fixed IP assignments, DNS records, and AP pinning with no confirmation step or safety interlock. A mistaken command can break client reachability, create naming collisions, or impair roaming behavior, which is significant in an infrastructure administration context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Timestamp rendering for known clients and events uses a fixed one-hour offset labeled as CET, which forces a specific locale/timezone behavior without user opt-in. This can misrepresent times for users in other regions and conflicts with the policy against forcing a locale choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.