Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it says, but it controls cloud-connected power devices using account credentials while carrying a concerning dependency chain that users should review before installing.
Install only if you are comfortable giving this skill Meross account credentials and authority to switch Meross plugs through the cloud. Review or update the npm dependency chain first, especially request, form-data, ip-address, and ws, and run it in an isolated environment with least-privilege/test Meross credentials where possible.
The skill is presented as using local CLI commands, but the content explicitly requires Meross cloud credentials and performs cloud discovery/control. This mismatch can mislead users and security reviewers about the real trust boundary, causing them to expose account credentials and permit networked cloud actions they did not intend.
The skill is presented as using local CLI commands, but the content explicitly requires Meross cloud credentials and performs cloud discovery/control. This mismatch can mislead users and security reviewers about the real trust boundary, causing them to expose account credentials and permit networked cloud actions they did not intend.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
Referenced artifact was not completely inspected
Use local `node dist/cli.js` only.
The lockfile includes form-data 2.5.5, which is flagged for CRLF injection in multipart field names/files. Although this skill appears to control Meross devices and may not directly expose multipart form construction to untrusted input, the dependency is present transitively via request, so the vulnerable code can exist in the runtime supply chain and could be exploitable if attacker-controlled multipart metadata is ever passed through.
The ip-address 10.2.0 package is flagged for address classification/parsing issues that can enable SSR or network-policy bypasses when applications rely on it for trust decisions. In this skill, the package is only a transitive dependency of socks/mqtt, so exploitability depends on whether the code uses proxy or address-filtering logic with attacker-influenced endpoints; that makes the risk real but context-limited.
ws 8.20.0 is flagged for memory disclosure and memory exhaustion issues. Because this skill depends on mqtt, which commonly uses WebSocket support and long-lived network connections, a vulnerable ws library is relevant: malformed remote traffic from a broker or intermediary could potentially trigger denial of service or expose process memory under certain usage patterns.
The lockfile pins form-data 2.5.5, which is flagged for CRLF injection in multipart field names/files. Even though this is a dependency-only finding and exploitability depends on whether attacker-controlled multipart field names are ever constructed, bundled vulnerable packages in an automation skill that may broker cloud/device communications present real supply-chain risk.
ip-address 10.2.0 is present and carries advisories around incorrect classification/parsing of special IPv6/IPv4-mapped addresses. In this skill, the package is pulled in through socks/mqtt rather than obviously used for security decisions directly, so the bug is real but context reduces likelihood of a direct exploit unless address classification is used to enforce SSRF or network policy boundaries.
ws 8.20.0 is present with advisories for memory disclosure and memory exhaustion via fragmented frames/chunks. Because meross-cloud depends on mqtt and ws for persistent messaging, a vulnerable WebSocket stack in a networked device-control skill is more concerning: it may process remote broker/cloud traffic continuously, increasing exposure to malformed frame attacks.
The skill declares shell and environment-variable dependent behavior but does not explicitly scope or constrain those capabilities with an allowlist such as permissions or allowed-tools. In an agent setting, this increases the chance of unintended command execution or credential access beyond what reviewers and policy controls expect, especially since the skill requires cloud account secrets and shell access.
The manifest says the skill is for discovery, state checks, and switch on/off actions, which suggests operational control of plugs. The setup-once command goes beyond that by generating and overwriting a local device registry from cloud discovery results, which is a separate setup/provisioning behavior not stated in the description.
The 'setup-once' path rebuilds the registry from discovered cloud devices and then unconditionally calls writeRegistryDevices(nextDevices), which can overwrite prior local registry contents without any confirmation, merge safety checks, or backup. In a skill that controls physical devices, this can silently replace aliases or remove manually maintained entries, causing mis-targeting of later control actions or loss of trusted local configuration.
This code reads Meross credentials from environment variables and constructs cloud connection options for a third-party service, which implies network transmission of account and device data. In this file there is no confirmation prompt, user-facing log/print, or comment/docstring warning users that credentials and device interactions will be sent to the Meross cloud.
The code issues control commands to turn devices on or off via controlToggleX/controlToggle, which is a safety-relevant action affecting physical devices. Although the skill's purpose may involve device control, this file itself provides no user-facing warning, confirmation, or explanatory comment indicating that invoking this path changes device state remotely.
The use of request is a genuine supply-chain security concern because it is abandoned and no longer receives security fixes. In a networked device-control skill, relying on an unmaintained HTTP client increases long-term exposure to newly discovered flaws and makes the package harder to secure over time.
request is explicitly deprecated and abandoned, which is a security concern even aside from any currently known CVEs because future flaws are unlikely to be fixed. In a cloud-connected automation skill, relying on an unmaintained HTTP client increases long-term exposure and makes other transitive issues like old form-data and uuid harder to remediate.
This code creates and overwrites a registry file via writeFile and rename, but there is no confirmation prompt, user-facing log/print, or explanatory comment describing that user/system state will be modified. Under the code-file criteria, file writes should have some visible disclosure unless the warning is provided elsewhere in markdown, which is not evident from this file alone.