Security audit

Japanese Smart Home Command Normalizer

Security checks across malware telemetry and agentic risk

Overview

The skill does not appear to steal data or call device APIs, but it can produce actionable curtain and TV intents despite presenting its current scope as lights and air conditioners.

Review before installing in any smart-home pipeline. Do not let downstream hooks auto-execute all returned intents unless you explicitly allow curtain and TV control, and keep a strict allowlist plus confirmation handling for ambiguous commands.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill metadata and documentation constrain behavior to lights and air conditioners, but the implementation reportedly also emits intents for curtains, TVs, and broader alias profiles. In a smart-home pipeline, this mismatch can cause downstream components to execute unintended device actions because callers may trust the documented scope when deciding whether automatic execution is safe.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The sample set expands behavior beyond the declared scope of lights and air conditioners by including curtain and TV commands. In an agentic smart-home pipeline, downstream systems may trust these examples as supported intents, causing unauthorized or unintended device control outside the user-expected capability boundary.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest says this skill is for Japanese smart-home normalization focused on lights and air conditioners, but deriveIntent also emits intents for curtains and TVs. That expands the effective control surface beyond the declared scope, which can cause downstream systems to execute unintended device actions if they trust the skill's output as policy-approved.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Curtain and TV control are not justified by the stated purpose of normalizing light and air-conditioner commands, so these branches represent undocumented capabilities. In voice-control systems, undocumented commands are risky because users, reviewers, and policy layers may not expect them, enabling overbroad actuation from ambiguous transcripts.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The examples map very broad phrases like 'つけて' and 'にして' to a confirmation-needed state, which is safer than direct execution, but still encourages invocation on underspecified commands. In a voice-control context this increases the risk of accidental triggering, intent confusion, or unsafe follow-on disambiguation if another component guesses the target device instead of requiring a strict clarification step.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The air-conditioner action list includes highly ambiguous phrases such as 「つけて」 and especially 「して」, which can match many ordinary utterances and collide with mode-setting language. In a smart-home control context, this raises the risk of misclassification and unintended device activation or mode changes after imperfect STT, making it a real safety and authorization-boundary issue even if not maliciously introduced.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The same trigger phrases are reused across light and aircon domains without clear scope constraints, for example 「つけて」 and 「消して」, which makes cross-device resolution dependent on imperfect transcript context. In a voice-controlled smart-home skill handling noisy STT drift, this can cause the wrong device to be controlled, creating unintended physical actions and reducing the reliability of any downstream safety checks.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.