ClawHub
Back to skill

Security audit

Local Tuya Light Control

Security checks across malware telemetry and agentic risk

Overview

This Tuya light-control skill is mostly coherent, but it asks the agent to edit its own installed instructions, so it should be reviewed before use.

Install only if you are comfortable with an agent controlling the listed local lamps and using the Tuya project files. Before use, remove or revise the instructions that tell the agent to update SKILL.md; keep machine-specific paths in a separate user-reviewed config instead. Verify the lamp registry and local keys are stored only where you expect.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Self-Modification

High
Category
Rogue Agent
Content
If a lamp was repaired, re-paired, or moved to another network, assume the `local_key` may have changed. Read `KEY_EXTRACTION.md` and `ONBOARDING.md`, refresh the key, test with the preferred CLI first (`lampctl <lamp> status`), then use `tuya_test_lamp.py --probe` if Python fallback is needed, and finally update `tuya_lamps.json`.

## Portability note
This skill intentionally prefers explicit standard project paths so it can still work after being copied into a separate OpenClaw skills directory. If a local installation uses a different layout, update this SKILL.md so the binary and project paths match that environment.

## Current live lamps
- `kitchen`
Confidence
90% confidence
Finding
update this SKILL

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal