Iobroker Simple Api

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:47 AM UTC
• Version: 1.3.0

Overview

This skill openly provides powerful ioBroker smart-home control, but it exposes script execution and device/state mutation without clear safety gates and defaults to insecure HTTP credential use.

Install only if you intend to give OpenClaw broad administrative control over ioBroker. Use a least-privileged ioBroker account, prefer HTTPS, avoid storing credentials for HTTP endpoints, and treat exec/eval and state-changing commands as dangerous operations that should require explicit human approval.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.js:230

Finding

Unrestricted ioBroker JavaScript Execution

Content

View full analysis

` or `eval:`. 3. The handler extracts everything after the command delimiter without validating its contents. 4. `executeScript()` places the supplied code in the `script` query parameter. 5. The Skill sends the request to ioBroker's `/exec` endpoint. 6. ioBroker executes the JavaScript with the authority available to the configured adapter and account. ### Impact Assessment Successful exploitation can allow an attacker to: - Read or mo ...[truncated 536 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill.js:67

Finding

Basic Authentication Credentials May Be Transmitted over Plaintext HTTP

Content

View full analysis

{ const parsedUrl = new URL(urlString); const isHttps = parsedUrl.protocol === 'https:'; const lib = isHttps ? https : http; const requestOptions = { hostname: parsedUrl.hostname, port: parsedUrl.port || (isHttps ? 443 : 80), path: parsedUrl.pathname + parsedUrl.search, method: options.method || 'GET', headers: { 'Accept': 'application/json', 'User-Agent': 'OpenClaw-ioBroker-Skill/1.0' }, timeout: CONFIG.timeout }; // Add auth header if credentials provided if (CONFIG.username && CONFIG.password) { const auth = Buffer.from(CONFIG.username + ':' + CONFIG.password).toString('base64'); requestOptions.headers['Authorization'] = 'Basic ' + auth; } ``` The documented configuration also recommends an HTTP URL: ```json { "entries": { "iobroker-simple-api": { "config": { "url": "http://CHANGE_ME_IP", "port": 8087, "username": "", "password": "" } } } } ``` ### Technical Analysis The client supports both HTTP and HTTPS, but it does not reject authenticated HTTP connections. The default and documented examples use an `http://` URL. HTTP Basic Authentication only Base64-encodes `username:password`; it ...[truncated 1590 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:176

Finding

Advertised Rate Limiting and Circuit-Breaker Protections Are Not Implemented

Content

View full analysis

Production-ready ioBroker client for OpenClaw automation. Full access to ioBroker via the simple-api adapter. Read states, objects, historical data, write to states, execute JavaScript, and monitor your smart home. The skill automatically handles caching, rate limiting, and circuit breaker protection. ``` ```md ### Caching - 30 second TTL for frequently accessed states - Automatic cache invalidation on writes ### Rate Limiting - 10 requests/second to prevent API flooding - Queue management for burst requests ### Circuit Breaker - Auto-recovery on failures - Exponential backoff with jitter ``` ### Technical Analysis The documentation explicitly claims that the Skill implements caching, a ten-request-per-second rate limit, burst queueing, a circuit breaker, and exponential backoff. The reviewed implementation contains none of these controls. Every accepted command can call `makeRequest()` immediately. There is no request counter, token bucket, concurrency limit, queue, cache, failure threshold, circuit state, retry scheduler, exponential backoff, or jitter. This discrepancy is security-relevant because operators may rely on controls that do not exist when granting the Skill access to a production automation environment. The missing controls are especially consequential for write operations and arbitrary script execution, where repeated requests can cause repeated physical actions or server load. ### Attack Path 1. A caller, malfunctioning automation, or attacker-controlled prompt causes the Skill to generate commands rapidly. 2. The handler processes each invocation without applying a rate or concurrency limit. 3. Every command immediately ...[truncated 814 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · README.md (reported line 8)May include surrounding context.

md

## Features

- 📊 **Full Read Access** - States, objects, historical data, search
- 📤 **Write Operations** - Set, toggle, setBulk, create, delete states
- 💻 **Script Execution** - Execute JavaScript in ioBroker
- ⚡ **Caching** - 30s TTL for frequently accessed states
- 🚦 **Rate Limiting** - 10 req/sec to prevent API flooding

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

md

| `toggle:<id>` | Toggle state |
| `setBulk:<id1>=<v1>&<id2>=<v2>` | Multiple writes |
| `create:<id>?common={...}` | Create state |
| `delete:<id>` | Delete state |

### System

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md

| `toggle:<id>` | Toggle state |
| `setBulk:<id1>=<v1>&<id2>=<v2>` | Multiple writes |
| `create:<id>?common={...}` | Create state |
| `delete:<id>` | Delete state |

### System

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

setBulk:javascript.0.light1=on&javascript.0.light2=off

text

### Create/Delete State

create:javascript.0.myNewState?common={"type":"number","name":"My State"}

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documents direct JavaScript execution via exec/eval without warning that this is arbitrary code execution against the connected ioBroker environment. In context, this is especially dangerous because the skill is positioned for production automation and 'full smart home control,' so misuse could lead to complete compromise of automations, data, and potentially the host environment.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md

- `skill.js` - Main implementation

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The handler exposes high-risk operations including set, toggle, create, exec, and eval directly from untrusted input with no confirmation, authorization layer, or allowlist. In this skill's context, that means a caller can not only change ioBroker states but also execute arbitrary JavaScript in the ioBroker environment, which can lead to full automation compromise, unsafe physical actions, and potential lateral movement via scripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises powerful write, delete, and JavaScript execution commands but provides no safety warning, authorization guidance, or restrictions on dangerous use. In a skill exposing home automation control, undocumented destructive capability and remote code execution materially increase the chance of misuse, operator error, or unsafe deployment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises broad access to ioBroker and mentions auto-detection from environment variables, but the manifest does not declare any explicit tool scope or permission boundaries. That creates unclear and potentially excessive access expectations, making it harder for operators to understand or constrain what the skill can touch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level description markets 'full access' including writing states and executing JavaScript, but provides no prominent warning that these actions can alter smart-home behavior, damage automations, or run arbitrary code on the ioBroker side. Presenting dangerous capabilities as routine operations increases the chance of accidental misuse by users or downstream agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes create/delete state operations without any caution, confirmation flow, or rollback guidance. In an automation platform, deleting or creating incorrect states can break automations, corrupt expected device behavior, or remove operational data relied on by other components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The loader explicitly passes selected parent-process environment variables into the VM context, making them directly readable by the untrusted skill code. Even though only OPENCLAW_HOME and HOME are exposed, this still leaks host-specific filesystem and runtime information and can assist further abuse, especially because the skill already has powerful capabilities and unrestricted require access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says the skill provides "Read-only config" while simultaneously offering "full ioBroker REST access." Full REST access commonly includes state writes, script execution, and other mutating operations, so the stated read-only limitation does not match the broader capability being declared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill reads configuration from paths derived from OPENCLAW_HOME and HOME and then consumes username and password values for API authentication. There is no nearby warning, comment, or user-facing message disclosing that local config files and credentials will be accessed for authentication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The request layer can send sensitive state data and Basic Authentication credentials over plain HTTP because baseUrl may be configured as http:// and there is no enforcement of TLS. In this skill's context, the traffic may include home automation data, control commands, and credentials; an attacker on the network could intercept or tamper with requests and responses.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json

"author": "OpenClaw",
  "license": "MIT",
  "dependencies": {
    "ws": "^8.14.0"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

The skill depends on the network-facing 'ws' library and does not pin an exact version, making it impossible to verify from the manifest whether deployed instances avoid known advisories. In a skill that exposes full ioBroker REST access, websocket-layer weaknesses could increase risk of denial of service or memory disclosure if a vulnerable release is resolved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.