Tuya Smart Home

• Analyzed: May 11, 2026, 5:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 609087d1c0023900832355afb99531bfd8e186c9969a363519fb16986900cd84
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to control Tuya/Smart Life devices via cloud or local APIs, which inherently requires network access and handling of sensitive credentials (Tuya Access ID/Secret, Local Key). All code (`scripts/tuya_control.py`, `scripts/tuya_scan.py`) uses standard Python libraries (`argparse`, `json`) and legitimate third-party Tuya libraries (`tinytuya`, `tuya-connector-python`) for its stated purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in the `SKILL.md` or `references/tuya_api.md` files. While passing credentials via command-line arguments (as shown in `SKILL.md` examples) can pose a risk in certain environments (e.g., shell history, process lists), this is a common pattern for CLI tools and does not indicate malicious intent within the skill's code itself, which merely consumes the provided arguments.