T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:270- Finding
Untrusted MQTT Data Can Prompt an LLM to Publish Attacker-Directed Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
mqttasgi - IOT backbone for Django
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent MQTT/Django documentation, but one AI home-automation example can send household sensor data to Anthropic and publish model-selected MQTT commands without validation.
Review the AI automation example carefully before installing or copying it. Do not let an LLM choose arbitrary MQTT topics or payloads for real devices; use broker ACLs, strict allowlists, structured outputs, rate limits, audit logs, and human or policy confirmation for consequential actions such as locks, alarms, heaters, pumps, or valves. Treat MQTT telemetry as private data before sending it to any external AI provider.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill includes an example that sends sensor data to Anthropic's external API and does not warn users that MQTT payloads and topic names may leave the local environment. In an IoT/home automation context, sensor streams can reveal occupancy, routines, device names, and other sensitive household telemetry, so silent transmission to a third party creates a real privacy and compliance risk.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md - The class is spelled `MqttComunicator` (one `m`) — this is an intentional (legacy) typo in the library. - Worker spawn/kill is only allowed from the master consumer (`app_id=0`). Calling it from a worker raises an error. - With mosquitto 2.x you need `allow_anonymous true` and an explicit `listener` line in `mosquitto.conf` for integration tests. - `connect_max_retries=0` means retry forever with exponential back-off (capped at 30 s).
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md - The class is spelled `MqttComunicator` (one `m`) — this is an intentional (legacy) typo in the library. - Worker spawn/kill is only allowed from the master consumer (`app_id=0`). Calling it from a worker raises an error. - With mosquitto 2.x you need `allow_anonymous true` and an explicit `listener` line in `mosquitto.conf` for integration tests. - `connect_max_retries=0` means retry forever with exponential back-off (capped at 30 s).