Xiaomi Air Purifier

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:19 AM UTC
• Version: 1.1.2

Overview

The skill mostly matches Xiaomi air-purifier control, but it exposes and stores reusable device tokens in ways users should review before installing.

Install only if you are comfortable giving the skill access to your Xiaomi account session and reusable local device tokens. Avoid running scripts/extract-token.js, remove or rotate the hardcoded token in scripts/test-local.js, keep generated config.json private, and confirm before allowing any power, mode, lock, buzzer, brightness, or fan-level changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill manifest does not declare permissions, yet the documented setup and behavior clearly rely on sensitive capabilities such as environment/config access and credential handling for Mi Cloud login. This creates a transparency and review gap: users and platforms cannot accurately assess what sensitive access the skill needs, increasing the chance of over-privileged or hidden data exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior materially exceeds the stated purpose: it appears to expose or cache sensitive device tokens and metadata, support direct local-network control, and include hardcoded device access details. In an IoT context this is dangerous because cloud tokens, device IDs, and local IPs can enable unauthorized device control, privacy leakage, and lateral movement on the home network if mishandled or disclosed.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This script uses stored Mi Home credentials to request the device list and then extracts and prints each purifier's local IP and token. Device tokens are sensitive secrets used for direct device access, and exposing them is not necessary for the stated skill purpose of routine monitoring and control, making this a clear credential-harvesting capability.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The package includes logic to enumerate devices and reveal their tokens, which exceeds the declared scope of controlling or checking purifier status. In this context, the capability is dangerous because the extracted token can enable unauthorized local control or follow-on access to Xiaomi devices on the user's network.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The script exposes control over buzzer, child lock, and display brightness, which goes beyond the stated skill description of checking air quality, status, and changing fan mode/level. This creates a scope mismatch: users or orchestrating agents may grant trust for limited purifier control, while the implementation can alter additional device behaviors that affect usability and household operation.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This script performs direct local-network control of the air purifier via the miio protocol, while the skill metadata says the integration is via Mi Cloud. That mismatch matters because local control expands the trust boundary to the LAN and enables device interaction using a hardcoded IP and token, which may bypass expected cloud-side controls, auditing, or user assumptions about how the skill operates.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The manifest uses broad activation language such as general requests to check air quality or control the purifier, which can overlap with ordinary user phrasing and cause over-triggering. In a skill that performs real-world device actions, ambiguous activation raises the risk of unintended execution, such as changing settings or powering devices on/off without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script reads local credential material from ~/.config/xmihome/credentials.json and immediately uses it to query Xiaomi cloud APIs without any user-facing disclosure, consent, or warning. Even if intended as a troubleshooting tool, accessing secret material silently increases the risk of unauthorized credential use and normalizes unsafe handling of authentication data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Printing raw device tokens to stdout creates an immediate exposure channel through terminals, logs, CI output, shell history capture, or remote session recording. Because these tokens are authentication secrets, simple disclosure may be enough for another process or operator to take unauthorized actions against the devices.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The file contains a hardcoded device authentication token and uses it to connect to a physical device. Embedded secrets in source code are highly sensitive because anyone with repository or package access can reuse the token to control or query the device, and the script also logs a token prefix that increases secret exposure in logs.

Credential Access

High

• Category: Privilege Escalation

Content

const fs = require('fs');
const path = require('path');

const CREDS_FILE = path.join(process.env.HOME, '.config/xmihome/credentials.json');

async function extract() {
    if (!fs.existsSync(CREDS_FILE)) {

• Confidence: 92% confidence
• Finding: credentials.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"off": "node scripts/purifier.js off"
  },
  "dependencies": {
    "xmihome": "^1.4.0"
  }
}

• Confidence: 88% confidence
• Finding: "xmihome": "^1.4.0"

VirusTotal

61/61 vendors flagged this skill as clean.