米家风扇控制

• Outcome: Review
• Latest audit: Jul 9, 2026 · 7:37 AM UTC
• Version: 1.0.0

Overview

This skill does what it says by controlling a Xiaomi fan, but it also handles Xiaomi account/session access and account-wide device inventory with weak disclosure and safeguards.

Install only if you are comfortable giving the skill Xiaomi account-backed access for device control. Run device listing only during setup, avoid sharing logs because they may contain device IDs and household inventory, and review/remove any copied .mijia_token if you do not want this skill to reuse an existing Xiaomi session.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares environment-variable requirements and operational capabilities but does not expose an explicit permissions model or user-facing disclosure of what access is needed. This can cause users or orchestrators to invoke a skill that interacts with account-linked devices and credentials without adequate consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is narrow fan control, but the documented behavior includes Xiaomi account login, token handling, device enumeration, and status querying beyond a single on/off action. This mismatch is dangerous because users and calling agents may authorize the skill under a narrower trust assumption than the actual account-level access and data exposure it requires.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is described as a fan-control tool, but the `list` command enumerates every Xiaomi device on the authenticated account and prints names, models, and device IDs. This exceeds the stated scope and creates unnecessary exposure of account-wide inventory data, which could aid device profiling, targeting, or misuse by downstream tools or logs.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Access to the full account device inventory is not justified by the narrow purpose of controlling a single fan once a device ID is configured. This violates least-privilege expectations and can leak sensitive household metadata about other smart devices tied to the same account.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README lists broad natural-language triggers like “开风扇” and “风扇状态” but does not define activation boundaries, confirmation requirements, or contextual constraints. For a physical device-control skill, unclear trigger scope can cause unintended invocation by an agent or user utterance, leading to unauthorized or accidental fan state changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README documents commands that immediately operate a real Xiaomi fan but does not warn that these actions change the state of a physical device. In agentic or tool-calling environments, omission of this warning increases the chance of users or orchestrators invoking commands without understanding they have real-world effects, causing unintended device operation.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Claiming compatibility with 'all AI tools' without defining strict activation or invocation constraints increases the chance that other agents will call the skill in unsafe or unintended contexts. In a device-control skill tied to an account, broad integration claims expand the attack surface and make prompt-driven accidental execution more likely.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Claiming compatibility with 'all AI tools' without defining strict activation or invocation constraints increases the chance that other agents will call the skill in unsafe or unintended contexts. In a device-control skill tied to an account, broad integration claims expand the attack surface and make prompt-driven accidental execution more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill description and usage guidance do not clearly warn that listing devices and controlling the fan involves Xiaomi account data, authentication, and visibility into all devices on the account. Missing this disclosure undermines informed consent and can lead users to expose broader household device metadata than expected.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"python": ">=3.8"
  },
  "dependencies": {
    "mijiaAPI": "^1.0.0"
  }
}

• Confidence: 87% confidence
• Finding: "mijiaAPI": "^1.0.0"

Known Vulnerable Dependency: flask — 9 advisory(ies): CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +6 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: flask

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.