Security audit

SwitchBot OpenAPI

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims, but it gives an agent broad control over locks, garage doors, keypad codes, scenes, and private MindClip data without strong confirmation or privacy boundaries.

Install only if you are comfortable giving the agent SwitchBot account authority. Use it for devices and MindClip data you own or are authorized to access, require explicit confirmation before unlock, garage, keypad, scene, or automation actions, and avoid displaying or logging tokens, transcripts, locations, or keypad passcodes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly enables access to highly sensitive AI MindClip data including recordings, transcriptions, summaries, todos, and daily memories containing location information, but it does not include a clear user-facing privacy warning or consent boundary. In an agent context, this can lead to over-collection or disclosure of intimate personal and workplace data without the operator adequately recognizing the sensitivity.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation provides ready-to-run commands for real-world actuation, including unlocking locks, creating keypad passcodes, opening garage doors, and controlling other physical devices, without a prominent general warning about safety, authorization, or physical consequences. In an autonomous or semi-autonomous agent setting, this increases the risk of unsafe, unauthorized, or destructive actions affecting property security and occupant safety.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document explicitly describes keypad passcodes as being supplied in plain text and gives no warning that these values are sensitive credentials. In a skill/reference context, users or downstream agents may log, echo, store, or mishandle these passcodes, increasing the risk of credential disclosure and unauthorized physical access.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The reference exposes endpoints for retrieving recordings, transcripts, summaries, todos, and assistant memory data without any privacy or data-handling warning. Because this data can contain highly sensitive personal conversations and behavioral information, documenting access paths without caution can lead to overcollection, unintended retention, or disclosure by integrators and agents.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: These examples demonstrate security- and safety-sensitive actions for physical devices such as smart locks without any cautionary language, authorization expectations, or misuse warnings. In a home-automation skill, copy-pastable unlock/lock commands can normalize unsafe operation and increase the chance of unauthorized or accidental physical access if users run examples against real devices.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation includes literal example passcodes for keypad creation, which can encourage insecure practices such as hardcoding credentials and reusing weak sample codes in production. In the context of access-control devices, showing real-looking static PIN values without warnings increases the risk that users will deploy predictable codes that could enable unauthorized entry.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:163