S2-SP-OS Energy Radar

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:42 PM UTC
• Version: 1.1.1

Overview

The skill is framed as a passive local energy dashboard, but it presents simulated appliance data as household facts and steers agents toward appliance power-control workflows outside that passive scope.

Review before installing. Treat this as a demo/local visualization skill unless it clearly labels measured inputs and data provenance. Do not let it configure or trigger smart-plug, HVAC, breaker, or other appliance-control automations based on its current output. Run it only in an isolated environment with pinned dependencies and a private output directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

• Location: energy.py:41
• Finding: Synthetic Appliance Data Is Presented as Real Household Telemetry<![CDATA[ ## Vulnerability Details **File Location**: `energy.py:41-50`, `energy.py:68-78`, `energy.py:97-105`, and `AGENT-EXAMPLES.md:27-49` **Vulnerability Type**: Data and tool-output spoofing **Risk Level**: High ### Vulnerable Code ```python # 1. 构建模拟的 20 个设备全屋盘点底座 data = [ {"Room": "Living Room", "Device": "Main AC", "Power_W": 2000}, {"Room": "Living Room", "Device": "Smart TV", "Power_W": 150}, {"Room": "Master Bed", "Device": "Bedroom AC", "Power_W": 1000}, {"Room": "Kitchen", "Device": "Refrigerator", "Power_W": 150}, {"Room": "Kitchen", "Device": "Microwave", "Power_W": 1000}, {"Room": "Bathroom", "Device": "Water Heater", "Power_W": 2000}, # ... 模拟 20 个设备缩略 {"Room": "Study", "Device": "Desktop PC", "Power_W": 300} ] df = pd.DataFrame(data) ``` ```python np.random.seed(42) days = np.arange(1, 31) daily_matrix = np.zeros((30, len(df))) for i, row in df.iterrows(): base_h = 4.0 # 模拟基准小时 noise = np.random.normal(loc=base_h, scale=base_h * 0.2, size=30) weekend_multiplier = np.where((days % 7 == 6) | (days % 7 == 0), 1.3, 1.0) hours = np.clip(noise * weekend_multiplier, 0, 24) daily_matrix[:, i] = (hours * row["Power_W"]) / 1000.0 ``` ```python return { "action": "generate_dashboard", "status": "success", "total_devices_analyzed": len(df), "peak_daily_kwh": round(float(np.max(total_daily_kwh)), 2), "generated_charts_uris": chart_paths, "vendor_nl": "Advanced data visualization generated locally. No cloud analytics used. / 高级可视化图表已在本地生成，零云端分析介入。" } ``` The accompanying Agent instructions state: ```markdown I know from the 20-device inventory that Main AC (2000W) and Water Heater (2000W) are the biggest power hogs. The tool reports a peak of 28.5 kWh. I should hypothesize this correlates with weekend usage patterns. Cross-Domain Action Plan: I will propose a specific, executable action using my other skills (like adjusting the AC via s2-atmos-perception or cutting standby p ...[truncated 2218 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Label every generated value and chart prominently as demonstration or simulated data. 2. Do not use the success schema for simulated reports unless the schema includes an explicit field such as: ```json { "data_source": "simulation", "is_measured": false } ``` 3. Accept measured input only through a documented, validated telemetry interface. 4. Attach provenance to every reported metric, including sensor identifier, collection time, units, and whether the value was measured or estimated. 5. Remove Agent instructions that characterize simulated results as actual household observations. 6. Ensure the documented number of devices matches the records actually processed. 7. Prevent physical-control recommendations when the input is synthetic or lacks trustworthy provenance. 8. Add tests that fail if demonstration data is returned without a conspicuous simulation marker. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: S2-MEMZERO-PROTOCOL.md:13
• Finding: Passive Monitoring Instructions Steer the Agent Toward Physical Device Control<![CDATA[ ## Vulnerability Details **File Location**: `S2-MEMZERO-PROTOCOL.md:13-19` and `AGENT-EXAMPLES.md:27-31,44-49` **Vulnerability Type**: Agent instruction hijacking and scope expansion **Risk Level**: High ### Vulnerable Instructions ```markdown ## 3. Agent Assignment Protocol (智能体策略分配原则) For every device mapped in the `device_topology`, the Central OS must mentally assign an Agent topology: - `smart: True` -> Assign to **Active Control Agent** (Can cut power/adjust state). - `smart: False` -> Assign to **Passive Notification Agent** (Can only alert the user via Digital Human UI). ``` The Agent example further states: ```markdown Cross-Domain Action Plan: I will propose a specific, executable action using my other skills (like adjusting the AC via s2-atmos-perception or cutting standby power via smart plugs) to prove I am an active OS, not just a dashboard. ``` It then proposes automation based on the generated report: ```markdown 人走灯灭/断电：允许我调用 s2-spectrum-perception（毫米波雷达），当检测到客厅连续 30 分钟无人（Occupancy: False）时，自动切断空调和电视的智能插座电源。 待机功耗清理：夜间深度睡眠期间，自动帮您切断微波炉、电脑等设备的待机电源。 ``` ### Technical Analysis The Skill identifies itself as a passive scanner and chart generator. Nevertheless, its instruction files tell the Agent to mentally assign active controllers to smart devices and propose executable actions through other skills. This is an instruction-level privilege and goal expansion. The charting Skill itself does not need authority to control appliances, invoke unrelated capabilities, or create automation policies. Loading it should not alter the Agent's behavior from passive reporting to safety-relevant physical actuation. The risk is compounded by the fact that the proposed control decisions can be based on the synthetic data generated by `energy.py`. ### Attack Path 1. The Agent loads the Skill to answer an energy-reporting request. 2. The Skill instructions require every smart device to be associated with an active control Agent. 3. `generate_dash ...[truncated 1454 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions requiring assignment to an active control Agent. 2. Explicitly constrain this Skill to read-only inventory, analysis, and local chart creation. 3. Do not instruct the Agent to invoke unrelated skills as proof of active behavior. 4. Separate physical actuation into an independently reviewed Skill with narrowly scoped permissions. 5. Require fresh, explicit user confirmation for each safety-relevant device action. 6. Display the exact device, proposed state change, reason, and data provenance before confirmation. 7. Prohibit automated control when inputs are simulated, stale, incomplete, or unauthenticated. 8. Apply allowlists and deny access to critical loads that must not be interrupted. 9. Require time limits, rollback behavior, audit logging, and an emergency override for any automation policy. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9
• Finding: Third-Party Dependencies Are Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9` and `setup-guide.md:7` **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Configuration ```yaml metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":["python3"], "pip":["pandas", "numpy", "matplotlib"], "env":["S2_PRIVACY_CONSENT"]}}} ``` The setup guide also instructs: ```bash pip install tflite-runtime opencv-python-headless numpy ``` ### Technical Analysis All listed Python packages are specified by mutable package names without exact versions, hashes, a lockfile, or a trusted-index requirement. Installation therefore resolves whichever compatible release is available at installation time. Although the reviewed project does not specify a known malicious package, this configuration creates a supply-chain exposure. A compromised upstream release, unsafe package index, dependency confusion condition, or unexpected future update could introduce code that executes during installation or import. The application imports these dependencies in `generate_dashboard`, so malicious module-level code would execute in the Python process when dashboard generation is requested. ### Attack Path 1. An operator installs the Skill's dependencies from the metadata or setup guide. 2. `pip` resolves mutable package names using the configured package index and dependency resolver. 3. A compromised, substituted, or unexpectedly changed package version is downloaded. 4. Package installation hooks may execute during installation. 5. Imported package initialization code executes when the dashboard action loads Pandas, NumPy, or Matplotlib. 6. The malicious dependency receives the same filesystem, environment, and process privileges as the user running the Skill. ### Impact Assessment The obtained privilege would be equal to that of the installation process or the Agent process importing the dependency. Depending on deployment practices, this could ...[truncated 468 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct and transitive dependency to a reviewed version. 2. Generate and commit a dependency lockfile. 3. Require package hashes, for example through a requirements file used with: ```bash pip install --require-hashes -r requirements.txt ``` 4. Configure an explicitly trusted package index and disable unapproved extra indexes. 5. Review dependency provenance and release signatures where available. 6. Use an isolated virtual environment or container running as a non-privileged user. 7. Automate vulnerability and provenance scanning for locked dependency versions. 8. Test dependency upgrades in a controlled environment before updating the lockfile. 9. Keep optional vision dependencies separate from the minimal dashboard runtime. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: energy.py:38
• Finding: Predictable Dashboard Filenames Permit Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `energy.py:38`, `energy.py:58-61`, and `energy.py:85-88` **Vulnerability Type**: Unsafe output-file creation **Risk Level**: Medium ### Vulnerable Code ```python output_dir = os.getcwd() chart_paths = [] ``` ```python bar_path = os.path.join(output_dir, 's2_appliance_bar.png') plt.tight_layout() plt.savefig(bar_path, dpi=100) plt.close() chart_paths.append(f"file://{bar_path}") ``` ```python line_path = os.path.join(output_dir, 's2_daily_trend.png') plt.tight_layout() plt.savefig(line_path, dpi=100) plt.close() chart_paths.append(f"file://{line_path}") ``` ### Technical Analysis The function writes to two constant filenames in the process's current working directory. It does not verify that the output directory is private, that the destination is a regular file, or that the destination is not a symbolic link. If another local user or process can modify the working directory, it can pre-create either expected filename as a symbolic link to another file writable by the Agent account. Matplotlib then opens the destination through that link and overwrites the target with PNG content. This is a time-of-check/time-of-use and unsafe-file-creation class of issue. Adding a separate existence check would not be sufficient because an attacker could replace the path between the check and the write. ### Attack Path 1. The Skill is run from a shared or attacker-controlled working directory. 2. An attacker creates a link such as: ```text s2_appliance_bar.png -> /path/to/a/file/writable/by/the-agent ``` 3. The user or Agent invokes the dashboard-generation action. 4. `plt.savefig()` follows the symbolic link. 5. The linked target is truncated or overwritten with PNG data. 6. If the target is an important configuration or application file, the associated service or workflow may fail. ### Impact Assessment The attacker does not gain arbitrary read access or direct code execution solely from this flaw. The ...[truncated 565 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a dedicated private output directory with permissions restricted to the current user. 2. Avoid the current working directory as an implicit storage location. 3. Generate unpredictable output names using a secure temporary-file API. 4. Open output files atomically with exclusive-creation and no-follow semantics where supported. 5. Pass an already secured file object to the image writer rather than reopening a pathname. 6. Verify that the final destination is a regular file owned by the expected user. 7. Write to a secured temporary file and atomically rename it into the private output directory. 8. Do not run dashboard generation with elevated privileges. 9. Delete obsolete chart files securely and apply restrictive file permissions to generated output. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The description is partially aligned: the code does local energy-style visualization, creates bar and trend charts, saves them locally, and does not use cloud analytics. However, there is a material description/behavior gap in the supplied chunk. The dashboard is built from hardcoded sample data and simulated 30-day consumption rather than actual spatial inventory data. Also, the description explicitly mentions Bar/Pie/Trend dashboards, but the shown implementation only produces bar and line/trend outputs, with no pie chart generation. Finally, inventory mapping and breaker-reading are declared as part of the skill’s purpose, but their implementations are omitted from the supplied chunk, so the actual demonstrated behavior is narrower than advertised. This is best classified as a mismatch because the represented capability suggests real local inventory-driven analytics, while the visible code mainly produces synthetic local visualizations.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The documentation says the skill is only a passive scanner/chart generator, but the example explicitly directs the agent to convert outputs into operational recommendations and to invoke other skills for power-cutting automations. This creates a scope-expansion hazard: downstream agents may treat descriptive telemetry as authorization for control actions, increasing the chance of unsafe or unintended actuation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The example pushes the agent beyond local visualization into proactive inference, behavioral interpretation, and home automation orchestration. That broadening is dangerous because an agent may over-trust the example as policy, make unsupported assumptions from energy charts, and trigger actions in other systems without explicit user intent or verified safety conditions.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The example response is written entirely in Chinese and addresses the user as '主人', with no indication that language choice is user-selectable or context-dependent. Under the policy criteria, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly documented and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown recommends automatic power-cutting of appliances and standby loads without warning about risks such as interrupting climate control, corrupting devices, disabling safety-critical equipment, or affecting user comfort and availability. In a home-automation context, presenting shutoff automation as a routine optimization can lead to real-world physical and operational consequences if copied by an agent or user without safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly assigns an 'Active Control Agent' the ability to cut power or adjust device state, but it provides no requirement for explicit user confirmation, authorization boundaries, safety interlocks, or warnings about system-impacting actions. In an energy-management skill, this materially increases risk because users may assume the feature is observational only, while the protocol enables actuator behavior that could disrupt appliances, safety devices, or critical household operations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to run local Python commands and generate local image files, but does not require a user-facing warning or confirmation before doing so. This is dangerous because users may not realize the agent is invoking local execution, creating files, and potentially exposing local file URIs in the response.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill says to generate dashboards whenever the user asks for an energy report, which is a broad natural-language trigger that could cause command execution in response to common phrasing without sufficiently explicit user consent. In an agentic context, overly broad invocation rules increase the chance of unintended local execution and file generation.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The file states 'You MUST present these image links directly to the user in your markdown response,' which mandates a specific presentation format regardless of user preference. This is a natural-language policy concern because it imposes an output mode without offering choice or documenting a justified requirement.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The banner line presents the skill description bilingually, which indicates a language preference is embedded in the skill. Under the policy rule, forcing or assuming a specific language/locale without user opt-in can be a natural-language policy issue, and no user choice or justification is visible in this file.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The skill returns a user-facing natural-language string in both English and Chinese regardless of any user preference. This is a locale/language policy concern because the file does not provide a language selection mechanism or explain why a fixed bilingual response is required.

Static analysis

No suspicious patterns detected.