Smart Home Planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.0

Overview

This is a real smart-home automation/setup skill, not just a planner, and it needs review because it can store credentials and control devices with weak scoping and safety defaults.

Install only if you intentionally want this skill to set up integrations and run local smart-home automations. Use a dedicated low-privilege account and isolated host, avoid LAN HTTP and default admin credentials, protect or delete token/profile files, pin and review dependencies before running setup scripts, disable Homebridge MCP admin tools unless needed, and require manual confirmation for locks, alarms, cameras, climate, plugs, and other safety-sensitive actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/homebridge_setup.sh:14

Finding

Privileged execution of a remotely retrieved installation script

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/automation_setup.sh:21

Finding

Unpinned third-party packages execute in security-sensitive integrations

Content

View full analysis

/dev/null || pip install mijiaAPI pyyaml requests ``` ```bash # Install mijiaAPI echo "" echo "Installing mijiaAPI..." pip3 install mijiaAPI 2>/dev/null || pip install mijiaAPI ``` ```bash # Install homebridge-mcp-server echo "" echo "Installing homebridge-mcp-server..." npm install -g @mp-consulting/homebridge-mcp-server ``` The Skill instructions also prescribe: ```markdown - Guide install: `pip install mijiaAPI` ... - Install MCP server: `npm install -g @mp-consulting/homebridge-mcp-server` ``` ### Technical Analysis The setup workflow installs mutable latest versions from public Python and npm registries. There is no lock file, exact version constraint, integrity hash, package signature check, or reviewed dependency manifest. These dependencies operate in a particularly sensitive context: - `mijiaAPI` receives Xiaomi authentication material and controls cloud-connected devices. - `homebridge-mcp-server` receives Homebridge credentials and exposes device and administrative functions to an AI agent. - Global npm installation may write to shared system-level package locations, depending on the npm configuration. - Package installation can execute package-controlled installation hooks or import-time code. Suppressing `pip3` error output with `2>/dev/null` also makes it harder for users to understand why the first installation attempt failed before the script falls back to `pip`. ### Attack Path 1. An attacker compromises a future release, maintainer account, transitive dependency, or package-registry distribution path. 2. A user runs one of the setup script ...[truncated 856 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: automation/plugins/homekit/homebridgeclient.py:10

Finding

Homebridge credentials and bearer tokens may be transmitted over plaintext HTTP

Content

View full analysis

bool: """Authenticate with Homebridge and get JWT token.""" try: resp = requests.post(f"{self.base_url}/api/auth/login", json={ "username": self.username, "password": self.password, }, timeout=10) if resp.status_code == 200: self._token = resp.json().get("access_token") return True ``` ```python def _headers(self, content_type: bool = False) -> Dict: """Build request headers.""" h = {"Authorization": f"Bearer {self._token}"} if content_type: h["Content-Type"] = "application/json" return h ``` ```yaml homekit: type: homebridge namespace: homekit homebridge_url: "http://localhost:8581" username: "admin" password: "admin" poll_interval: 30 ``` The guide explicitly recommends plaintext HTTP across a LAN: ```bash export HOMEBRIDGE_URL="http://192.168.1.100:8581" export HOMEBRIDGE_USERNAME="admin" export HOMEBRIDGE_PASSWORD="your-password" ``` ### Technical Analysis The client posts a reusable username and password to the configured URL and subsequently sends a bearer JWT in the `Authorization` header. No validation requires HTTPS for non-loopback hosts. Plaintext HTTP on loopback is materially less exposed, but the documentation explicitly extends the same confi ...[truncated 1416 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: automation/run_automations.py:274

Finding

Automation validation fails open and ignores documented trigger safeguards

Content

View full analysis

bool: ctype = cond.get("condition") if ctype == "state": entity_id = cond.get("entity_id") expected = cond.get("state") if entity_id and expected is not None: return str(self.state.get(entity_id, {}).get("state")) == str(expected) elif ctype == "time": now = datetime.now().strftime("%H:%M:%S") if cond.get("after") and now < cond["after"]: return False if cond.get("before") and now > cond["before"]: return False return True elif ctype == "and": return self._evaluate_conditions(cond.get("conditions", [])) elif ctype == "or": return any(self._evaluate_single_condition(c) for c in cond.get("conditions", [])) elif ctype == "not": return not self._evaluate_conditions(cond.get("conditions", [])) return True ``` ```python def _check_time_triggers(self): now = datetime.now().strftime("%H:%M:%S") for auto in self.automations: for trigger in auto.get("trigger", []): if trigger.get("platform") == "time": at_time = trigger.get("at") if at_time and now >= at_time: auto_id = auto.get("id", "unknown") if time.time() - self._last_triggered.get(auto_id, 0) > 60: print(f"[Engine] >>> Time trigger: {auto.get('alias', auto_id)}") self._last_triggered[auto_id] = time.time() asyncio.create_task(self._execute_actions(auto["action"])) ``` The bundled automation relies on a `for` safeguard: ```yaml - id: away_mode alias: "离家模式" ...[truncated 2449 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: knowledge/homekit-guide.md:119

Finding

Agent integration exposes unnecessary Homebridge administrative capabilities

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (68)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest suggests broad planning/configuration help, but the content includes host-level software installation via npm and service connectivity checks against Homebridge/Homebridge MCP. Installing software and probing local services are materially more privileged than ordinary advice, and can modify the host or expose internal-network details without clear up-front disclosure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest suggests broad planning/configuration help, but the content includes host-level software installation via npm and service connectivity checks against Homebridge/Homebridge MCP. Installing software and probing local services are materially more privileged than ordinary advice, and can modify the host or expose internal-network details without clear up-front disclosure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest suggests broad planning/configuration help, but the content includes host-level software installation via npm and service connectivity checks against Homebridge/Homebridge MCP. Installing software and probing local services are materially more privileged than ordinary advice, and can modify the host or expose internal-network details without clear up-front disclosure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest suggests broad planning/configuration help, but the content includes host-level software installation via npm and service connectivity checks against Homebridge/Homebridge MCP. Installing software and probing local services are materially more privileged than ordinary advice, and can modify the host or expose internal-network details without clear up-front disclosure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest suggests broad planning/configuration help, but the content includes host-level software installation via npm and service connectivity checks against Homebridge/Homebridge MCP. Installing software and probing local services are materially more privileged than ordinary advice, and can modify the host or expose internal-network details without clear up-front disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs storage of service URLs, credentials, and tokens in local profile/auth files without an explicit security warning, storage hardening guidance, or least-privilege handling. If those files are exposed, an attacker could gain control over smart-home platforms, enumerate devices and scenes, and potentially infer occupancy or manipulate physical devices.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly instructs obtaining long-lived access tokens and saving them for later API use, which is credential acquisition and persistence. In this context that is dangerous because long-lived tokens often grant broad control over home automation systems and, if mishandled, can enable persistent unauthorized access to device state and control endpoints.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

### Step 2: If User Grants Access — Guide API Setup

**Home Assistant:**
- Guide to Settings → Long-Lived Access Tokens
- Save URL and token to profile
- Test connection with a simple API call

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The plugin exposes live actuation methods through call_service(), including property writes, scene execution, and device actions. That exceeds the skill's declared purpose of planning, comparison, and configuration assistance, so if this skill is invoked or reused by an agent it could perform real-world smart-home changes such as unlocking, powering devices, or triggering scenes without user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Direct home-automation actuation is implemented via set_device_property, run_scene, and run_device_action, giving the code the ability to change the physical environment. In the context of a skill advertised as a planner/setup assistant, this mismatch is dangerous because downstream systems or users may trust it as advisory-only while it can actually control devices.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements a full standalone automation engine that polls device state, evaluates triggers and conditions, and executes actions against real smart-home platforms. That exceeds the declared role of a planning/recommendation skill and creates an unauthorized actuation surface where a user or downstream component could cause real-world device changes rather than receiving advice only.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The action handlers directly invoke Mijia and HomeKit operations such as turning devices on/off, running scenes, and setting accessory characteristics. In the context of a planner skill, this is dangerous because generated or loaded automation data can trigger immediate physical-world actions without clear consent boundaries, enabling misuse of locks, lights, switches, climate, or scenes.

Content

No source excerpt is available for this finding.

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Using --net=host removes network isolation between the container and host, expanding the blast radius if Homebridge or a plugin is compromised. In this skill's context, Homebridge manages smart-home devices and exposes a REST API, so host networking makes lateral movement, service exposure, and host-level network abuse more dangerous.

Content

Scanner excerpt · knowledge/homekit-guide.md (reported line 38)May include surrounding context.

md

# Option B: Docker
docker run -d --name homebridge --restart=unless-stopped \
  --net=host \
  -e HOMEBRIDGE_CONFIG_UI=1 \
  -e HOMEBRIDGE_CONFIG_UI_PORT=8581 \
  -v ~/homebridge:/homebridge \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · knowledge/platforms.md (reported line 9)May include surrounding context.

md

**Config:** YAML + UI (since 2023.7+ most things configurable via UI)
**Automation syntax:** triggers / conditions / actions
**API:** REST API + WebSocket
**Auth:** Long-lived access tokens (Settings → Long-Lived Access Tokens)
**Server required:** Yes (Raspberry Pi, NAS, PC, or HA Cloud)
**Best for:** Geeks, advanced users, multi-platform integration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · knowledge/platforms.md (reported line 9)May include surrounding context.

md

**Config:** YAML + UI (since 2023.7+ most things configurable via UI)
**Automation syntax:** triggers / conditions / actions
**API:** REST API + WebSocket
**Auth:** Long-lived access tokens (Settings → Long-Lived Access Tokens)
**Server required:** Yes (Raspberry Pi, NAS, PC, or HA Cloud)
**Best for:** Geeks, advanced users, multi-platform integration

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The documented Docker command uses --net=host, which removes network namespace isolation and gives the container direct access to the host network stack. In a smart-home environment, that broadens exposure of Homebridge and any compromised plugin or service, potentially enabling easier lateral movement, local service discovery, and access to sensitive LAN devices and management interfaces.

Content

Scanner excerpt · knowledge/platforms.md (reported line 154)May include surrounding context.

bash

# Install Homebridge (Docker)
docker run -d --name homebridge --net=host \
  -e HOMEBRIDGE_CONFIG_UI=1 -e HOMEBRIDGE_CONFIG_UI_PORT=8581 \
  -v ~/homebridge:/homebridge homebridge/homebridge:latest

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script checks for Mijia credentials and, if absent, triggers a live interactive login through a Python API. That causes credentialed access to a third-party smart-home account from a setup helper, which is more dangerous in this context because the skill is described as planning/configuration assistance rather than an account-integrating management tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script writes plugin files directly into the installed AppDaemon package directory, modifying local application code rather than limiting itself to user configuration. This creates persistence and code-execution risk because those Python files may be loaded by AppDaemon later, and the behavior is unusually invasive for a smart-home planning skill.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/homebridge_setup.sh (reported line 14)May include surrounding context.

sh

if ! command -v node &> /dev/null; then
    echo "Error: Node.js not found. Please install Node.js 18+ first."
    echo "  macOS:   brew install node"
    echo "  Linux:   curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - && sudo apt install -y nodejs"
    exit 1
fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/homebridge_setup.sh (reported line 14)May include surrounding context.

sh

if ! command -v node &> /dev/null; then
    echo "Error: Node.js not found. Please install Node.js 18+ first."
    echo "  macOS:   brew install node"
    echo "  Linux:   curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - && sudo apt install -y nodejs"
    exit 1
fi

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · scripts/automation_setup.sh (reported line 79)May include surrounding context.

sh

echo "Warning: Homebridge not reachable at $HB_URL"
    echo ""
    echo "You need to install and start Homebridge first:"
    echo "  Docker:  docker run -d --name homebridge --net=host -e HOMEBRIDGE_CONFIG_UI=1 -v ~/homebridge:/homebridge homebridge/homebridge:latest"
    echo "  npm:     npm install -g homebridge homebridge-config-ui-x && homebridge"
    echo ""
    echo "Then set environment variables:"

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · scripts/homebridge_setup.sh (reported line 47)May include surrounding context.

sh

echo "Warning: Homebridge not reachable at $HB_URL"
    echo ""
    echo "You need to install and start Homebridge first:"
    echo "  Docker:  docker run -d --name homebridge --net=host -e HOMEBRIDGE_CONFIG_UI=1 -v ~/homebridge:/homebridge homebridge/homebridge:latest"
    echo "  npm:     npm install -g homebridge homebridge-config-ui-x && homebridge"
    echo ""
    echo "Then set environment variables:"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes behaviors that involve file reads/writes, network/API access, and shell/package-install commands, but it does not declare any tool scope or permission boundary. That makes the skill's effective capabilities opaque to the host and user, increasing the chance of over-broad execution, silent persistence, credential handling, or command execution in contexts that expected a planning-only assistant.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger terms are broad enough to match many ordinary 'smart home' or setup-related requests, which increases the chance the skill activates in contexts where users only wanted generic advice. Because this skill also includes credential handling, local persistence, API use, and automation setup, over-broad activation becomes more dangerous than it would be for a purely informational skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## Safety Rules

- Treat door locks, cameras, and alarm-like scenes as opt-in and require explicit confirmation.
- Prefer manual override and fail-safe defaults when power loss, network loss, or cloud outage would create risk.
- For motion-based automations, use conservative defaults and keep false-trigger handling visible.
- Do not assume a risky automation is acceptable just because it is technically possible.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs persistent storage of a user household profile and repeated updates to that file, but it does not require a clear, explicit disclosure of what is stored, for how long, and who can access it. Household layout, membership, platform details, and special needs are sensitive in a smart-home context because they can reveal occupancy, lifestyle, and security posture.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.