米家风扇控制

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 1.0.0

Overview

This fan-control skill is mostly coherent, but it silently copies a Xiaomi auth token from another skill and exposes broad smart-home device inventory, so it needs review before installation.

Install only if you are comfortable granting this skill Xiaomi account-backed smart-home access. Before use, remove or approve the token-copy behavior explicitly, prefer pinned dependencies, and avoid running the list command unless you accept exposing all Mijia device names, IDs, and models to the agent output/logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: install.sh:35

Finding

Undisclosed Cross-Skill Authentication Token Copying

Content

View full analysis

/dev/null || true fi ``` ### Technical Analysis The installation script searches another Skill's directory for a Xiaomi authentication token and copies that token into the current project directory. This crosses a Skill isolation boundary and violates least privilege because installation does not need to duplicate an existing credential merely to create a virtual environment and install dependencies. The copy operation does not specify restrictive destination permissions. Its effective permissions therefore depend on the source mode and local environment. Duplicating the token increases the number of locations from which account credentials can be exposed through local access, backups, diagnostic archives, or later package modifications. The behavior is not disclosed in the documented installation procedure. In addition, `2>/dev/null || true` suppresses copy errors, making the credential operation less visible to the user. The reviewed project does not explicitly exfiltrate the copied token to an unrelated destination, so the confirmed issue is unauthorized credential access and expansion of credential exposure rather than confirmed theft. ### Attack Path 1. A user has previously authenticated through the sibling `mijia` Skill, creating `$HOME/.qclaw/skills/mijia/.mijia_token`. 2. The user installs this Skill by running `bash install.sh`. 3. The installer detects and reads the sibling Skill's token without requesting explicit consent. 4. The token is duplicated into the current Skill directory as `.mijia_token`. 5. Any process, dependency, backup operation, packaging process, or future code with access to this directory may ...[truncated 714 chars]

Remediation

View remediation

/dev/null || true`; report failures without printing secret contents. 7. Document credential storage, token lifetime, revocation procedures, and all components that can access the token. ]]>

T08 · Insecure Dependencies

Warning

• Location: install.sh:29

Finding

Unpinned and Inconsistent Third-Party Dependency Installation

Content

View full analysis

=3.13" dependencies = [ "flask>=3.1.3", "mijiaapi>=3.0.5", ] ``` Package manifest declaration: ```json "dependencies": { "mijiaAPI": "^1.0.0" } ``` ### Technical Analysis The executed installer downloads `mijiaAPI` without pinning an exact version or validating an artifact hash. It also upgrades `pip` to the latest available release during installation. Consequently, the code installed on a user's system can change over time even when the reviewed Skill package remains unchanged. The dependency manifests are inconsistent: - `install.sh` and `SKILL.md` install an unrestricted `mijiaAPI`. - `package.json` declares `mijiaAPI` with a version expression that belongs to the Node ecosystem, even though the runtime imports a Python package. - `pyproject.toml` requires `mijiaapi>=3.0.5`, adds the otherwise unused Flask package, and specifies Python 3.13 or newer. - The documentation states Python 3.8 or newer. These discrepancies prevent reproducible installation and make it unclear which dependency set was reviewed and intended. Because Python packages may execute build or installation hooks, a compromised or unexpectedly changed release can execute code during in ...[truncated 1599 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/fan_cli.py:115

Finding

Documented Fan Speed Range Is Not Enforced

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares environment-variable requirements and operational capabilities but does not define any explicit tool scope or permission boundaries. In practice, this leaves callers and host frameworks without a machine-readable restriction on what the skill is allowed to access, increasing the chance of overbroad execution or unsafe integration assumptions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents the skill as fan control, but the documented interface also supports listing all Mijia devices. This creates a scope mismatch that can mislead users and orchestrators, enabling broader device discovery than expected and exposing metadata about other household devices.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are generic and likely to appear in ordinary conversation, making unintended invocation more plausible. For a skill that can change the state of a physical device, accidental execution can cause unauthorized or surprising actions without a clear user intent boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

A fan-control skill only needs access to one specific device, but the documented list command enumerates all Mijia devices tied to the account. That broader discovery capability increases privacy exposure and expands the blast radius if the skill is invoked unintentionally or by another agent workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer automatically copies an existing Xiaomi authentication token from another skill directory into this skill's working directory without informing the user or requesting consent. Secret material should not be replicated silently, because it broadens exposure of valid credentials to additional code and directories and can enable unintended device/account access if this skill or directory is later read, shared, or compromised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as fan-only control, but the list command calls api.get_device_list() and prints every Xiaomi device name, DID, and model on the linked account. In an agent-skill context, this broadens data access beyond the stated purpose and can disclose unrelated home inventory information to the caller or downstream logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The list command exposes account-wide device metadata, including names, IDs, and models, without an explicit disclosure warning or access minimization. These details can reveal sensitive information about the user's home environment and provide identifiers that enable further targeting of other devices on the account.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language mapping specifies direct execution for broad phrases but does not define constraints, exclusions, or confirmation requirements. This makes the skill easier to trigger from ambiguous user input, especially for commands that alter device state or reveal device inventory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script's comments and user-visible output are entirely in Chinese, including usage instructions and status/error messages. This creates a language/locale constraint without any opt-in or documented justification, which matches the policy category for forced language behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The dependency is specified with a caret range (^1.0.0), which allows automatic installation of newer compatible releases rather than a single reviewed version. If the upstream package is compromised, publishes a malicious update, or introduces a breaking security issue, this skill could pull that version during install and execute attacker-controlled code in the supply chain.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"python": ">=3.8"
  },
  "dependencies": {
    "mijiaAPI": "^1.0.0"
  }
}

Unverifiable Dependency: flask has 10 known advisory(ies) (CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's usage text, help descriptions, and output strings are written in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when documented and justified or when the user is offered a language choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.