Meross Smart

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:11 PM UTC
• Version: 1.0.27

Overview

The skill does what it says, but it controls cloud-connected power devices using account credentials while carrying a concerning dependency chain that users should review before installing.

Install only if you are comfortable giving this skill Meross account credentials and authority to switch Meross plugs through the cloud. Review or update the npm dependency chain first, especially request, form-data, ip-address, and ws, and run it in an isolated environment with least-privilege/test Meross credentials where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as using local CLI commands, but the content explicitly requires Meross cloud credentials and performs cloud discovery/control. This mismatch can mislead users and security reviewers about the real trust boundary, causing them to expose account credentials and permit networked cloud actions they did not intend.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is presented as using local CLI commands, but the content explicitly requires Meross cloud credentials and performs cloud discovery/control. This mismatch can mislead users and security reviewers about the real trust boundary, causing them to expose account credentials and permit networked cloud actions they did not intend.

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use local `node dist/cli.js` only.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Known Vulnerable Dependency: form-data==2.5.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The lockfile includes form-data 2.5.5, which is flagged for CRLF injection in multipart field names/files. Although this skill appears to control Meross devices and may not directly expose multipart form construction to untrusted input, the dependency is present transitively via request, so the vulnerable code can exist in the runtime supply chain and could be exploitable if attacker-controlled multipart metadata is ever passed through.

Known Vulnerable Dependency: ip-address==10.2.0 — 3 advisory(ies): CVE-2026-54272 (ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSR); CVE-2026-69198 (ip-address: a CIDR suffix on the parsed address suppresses special-use classific); CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The ip-address 10.2.0 package is flagged for address classification/parsing issues that can enable SSR or network-policy bypasses when applications rely on it for trust decisions. In this skill, the package is only a transitive dependency of socks/mqtt, so exploitability depends on whether the code uses proxy or address-filtering logic with attacker-influenced endpoints; that makes the risk real but context-limited.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: ws 8.20.0 is flagged for memory disclosure and memory exhaustion issues. Because this skill depends on mqtt, which commonly uses WebSocket support and long-lived network connections, a vulnerable ws library is relevant: malformed remote traffic from a broker or intermediary could potentially trigger denial of service or expose process memory under certain usage patterns.

Known Vulnerable Dependency: form-data==2.5.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The lockfile pins form-data 2.5.5, which is flagged for CRLF injection in multipart field names/files. Even though this is a dependency-only finding and exploitability depends on whether attacker-controlled multipart field names are ever constructed, bundled vulnerable packages in an automation skill that may broker cloud/device communications present real supply-chain risk.

Known Vulnerable Dependency: ip-address==10.2.0 — 3 advisory(ies): CVE-2026-54272 (ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSR); CVE-2026-69198 (ip-address: a CIDR suffix on the parsed address suppresses special-use classific); CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco)

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: ip-address 10.2.0 is present and carries advisories around incorrect classification/parsing of special IPv6/IPv4-mapped addresses. In this skill, the package is pulled in through socks/mqtt rather than obviously used for security decisions directly, so the bug is real but context reduces likelihood of a direct exploit unless address classification is used to enforce SSRF or network policy boundaries.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: ws 8.20.0 is present with advisories for memory disclosure and memory exhaustion via fragmented frames/chunks. Because meross-cloud depends on mqtt and ws for persistent messaging, a vulnerable WebSocket stack in a networked device-control skill is more concerning: it may process remote broker/cloud traffic continuously, increasing exposure to malformed frame attacks.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares shell and environment-variable dependent behavior but does not explicitly scope or constrain those capabilities with an allowlist such as permissions or allowed-tools. In an agent setting, this increases the chance of unintended command execution or credential access beyond what reviewers and policy controls expect, especially since the skill requires cloud account secrets and shell access.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest says the skill is for discovery, state checks, and switch on/off actions, which suggests operational control of plugs. The `setup-once` command goes beyond that by generating and overwriting a local device registry from cloud discovery results, which is a separate setup/provisioning behavior not stated in the description.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The 'setup-once' path rebuilds the registry from discovered cloud devices and then unconditionally calls writeRegistryDevices(nextDevices), which can overwrite prior local registry contents without any confirmation, merge safety checks, or backup. In a skill that controls physical devices, this can silently replace aliases or remove manually maintained entries, causing mis-targeting of later control actions or loss of trusted local configuration.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code reads Meross credentials from environment variables and constructs cloud connection options for a third-party service, which implies network transmission of account and device data. In this file there is no confirmation prompt, user-facing log/print, or comment/docstring warning users that credentials and device interactions will be sent to the Meross cloud.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code issues control commands to turn devices on or off via controlToggleX/controlToggle, which is a safety-relevant action affecting physical devices. Although the skill's purpose may involve device control, this file itself provides no user-facing warning, confirmation, or explanatory comment indicating that invoking this path changes device state remotely.

Abandoned Dependency: request is unmaintained and no longer receives security updates

Medium

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The use of request is a genuine supply-chain security concern because it is abandoned and no longer receives security fixes. In a networked device-control skill, relying on an unmaintained HTTP client increases long-term exposure to newly discovered flaws and makes the package harder to secure over time.

Abandoned Dependency: request is unmaintained and no longer receives security updates

Medium

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: request is explicitly deprecated and abandoned, which is a security concern even aside from any currently known CVEs because future flaws are unlikely to be fixed. In a cloud-connected automation skill, relying on an unmaintained HTTP client increases long-term exposure and makes other transitive issues like old form-data and uuid harder to remediate.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This code creates and overwrites a registry file via writeFile and rename, but there is no confirmation prompt, user-facing log/print, or explanatory comment describing that user/system state will be modified. Under the code-file criteria, file writes should have some visible disclosure unless the warning is provided elsewhere in markdown, which is not evident from this file alone.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: dist/merossClient.js:104