T09 · Insecure Skill Coding Practices
Error
- Location
references/my_private_devices.md:1- Finding
Private Xiaomi Device Credentials Committed in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
小米家居 (Xiaomi Home)
Security checks for vulnerabilities and agentic risk
Overview
This skill needs Review because it ships and encourages plaintext Xiaomi device credentials and includes broad cloud token extraction with unsafe secret handling, though I found no clear exfiltration or backdoor.
Do not install this version unless the private credentials have been removed and rotated, token storage has been moved out of Markdown/source files, secret-bearing logs and plaintext exports have been fixed, and cloud token extraction is clearly scoped and consented. Treat any included Xiaomi tokens, BLE keys, router/camera details, and generated debug logs as sensitive credentials.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:25- Finding
Users Are Directed to Store Device Tokens in Agent-Readable Markdown
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/token_extractor.py:324- Finding
Debug Logging Exposes Xiaomi Authentication Secrets
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/token_extractor.py:778- Finding
QR and CAPTCHA Images Are Served on All Network Interfaces
- Content
View full analysis
None: class ImgHttpHandler(BaseHTTPRequestHandler): def do_GET(self) -> None: self.send_response(200) self.end_headers() self.wfile.write(image) def log_message(self, msg, *args) -> None: _LOGGER.debug(msg, *args) httpd = HTTPServer(("", 31415), ImgHttpHandler) _LOGGER.info("server address: %s", httpd.server_address) _LOGGER.info("hostname: %s", socket.gethostname()) thread = threading.Thread(target = httpd.serve_forever) thread.daemon = True thread.start() ``` ### Technical Analysis Passing an empty address to `HTTPServer` binds the image service to all available interfaces rather than loopback only. Any client that can reach port `31415` can request any path and receive the in-memory QR or CAPTCHA image. There is no authentication, random path, request limit, timeout, or explicit shutdown. The `--host` option only changes the URL displayed to the user; it does not constrain the bind address. Logging the hostname is local diagnostic behavior and is not itself network reconnaissance, but binding the server globally exceeds the minimum privilege required to display an image locally. ### Attack Path 1. The user starts password or QR authentication. 2. The extractor binds TCP port `31415` on all interfaces. 3. A host on the same network scans or directly requests the port. 4. The server returns the current authentication image without authorization. 5. The remote party obtains challenge material and may interfere with or observe the authentication workflow, subject to Xiaomi's additional validation requirements. ### Impact Assessment The service exposes sensitive authentication images to ot ...[truncated 327 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/token_extractor.py:47- Finding
Xiaomi Account Password Can Be Passed Through Process-Visible Arguments
- Content
View full analysis
`, particularly in non-interactive mode. 2. The complete command is retained in shell history, automation logs, or process metadata. 3. Another local user, administrator, monitoring se ...[truncated 530 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/token_extractor.py:885- Finding
Extracted Device Credentials Are Written Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:4- Finding
Installation Executes Unpinned Third-Party Packages
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to perform local LAN control via miiocli, but the documented behavior and referenced bundled script include Xiaomi cloud login, account/session handling, device inventory retrieval, and token extraction. This mismatch is dangerous because users may authorize a seemingly local-control skill without realizing it collects sensitive cloud-derived credentials that enable control of physical devices.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file contains plaintext Xiaomi device tokens, private IP addresses, and device inventory details for multiple networks. These tokens can enable unauthorized control of local smart devices and expose sensitive infrastructure information; in the context of a Xiaomi Home control skill, the credentials are directly actionable and substantially increase the risk of device compromise, surveillance abuse, or lateral targeting on the LAN.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This script performs Xiaomi cloud authentication, enumerates homes/devices across regions, and extracts device tokens and BLE beacon keys. That behavior materially exceeds the skill's stated LAN-only local-control purpose, creating an overprivileged credential-harvesting capability that could expose the user's cloud account and enable broader device compromise.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Debug logging includes the full login request fields, which contain the username and password-derived MD5 hash. Even if not the plaintext password, this is sensitive authentication material that can be reused for offline attacks, credential correlation, or account compromise if logs are exposed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script logs recovered session secrets such as ssecurity/psecurity from the extension-pragma header. These values are session-critical and can allow an attacker with log access to hijack authenticated API activity or derive further protected requests.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script prints device tokens and BLE keys to the console and can persist them to disk in the output file. These secrets enable control or impersonation of Xiaomi devices, so exposing them without strong safeguards significantly increases the risk of device takeover and lateral misuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares executable installation steps and documents networked/cloud interactions plus local credential storage, but it does not declare any explicit tool scope or permissions boundary. That makes the skill harder to sandbox and review, and can allow broader-than-expected file-write or network access during installation and operation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest emphasizes local LAN control, but the setup instructions direct users to fetch device IPs and tokens from Xiaomi Cloud. This is sensitive credential acquisition, and presenting it as routine setup without clear disclosure can mislead users into exposing account-linked device secrets.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Built-in token extraction from Xiaomi Cloud exceeds the narrowly stated purpose of local device control and grants access to secrets that can be reused outside this skill. In the context of smart-home control, leaked or mishandled tokens can enable unauthorized control, device inventory disclosure, and persistence of access beyond a single session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes extracting Xiaomi device tokens and storing device details locally but does not warn that these are sensitive credentials. Users may place tokens in markdown/reference files without understanding that anyone with file access could reuse them to control devices on the local network.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language intent section maps casual user phrases directly to power-state and property-changing commands for real-world devices, but it lacks any warning or confirmation guidance. In a home-automation context, silent execution can cause unsafe or unintended physical actions, especially for appliances like heaters or cookers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The template explicitly tells users to record device IPs and authentication tokens in a markdown file, but provides no warning that tokens are sensitive secrets or guidance on protecting them. In the context of a Xiaomi LAN-control skill, those tokens can enable unauthorized control of smart-home devices if the file is exposed through source control, backups, logs, or shared workspaces.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script starts an HTTP server bound to all interfaces on port 31415 to serve QR/captcha images. Even though intended for convenience, exposing a local unauthenticated server is unnecessary to core device control and can leak login artifacts to other hosts on the network or broaden the attack surface.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The document mixes English headings with device names presented in Chinese, but provides no indication that the locale is optional, user-selected, or required for a region-specific purpose. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code sets locale values such as en_GB and later en_US in multiple request parameters and cookies, forcing a specific locale behavior. There is no user opt-in or documentation explaining why English locales are required, which fits the language/locale policy concern.
- Content
Static analysis
No suspicious patterns detected.