Security audit

Nest SDM

Security checks for vulnerabilities and agentic risk

Overview

This Nest skill is mostly purpose-aligned, but it handles sensitive home, camera, cloud, and messaging access with unsafe scripting patterns that need review before installation.

Install only if you are comfortable granting this skill access to control Nest devices, access camera-related data, create and modify Google Pub/Sub/IAM resources, store OAuth refresh tokens locally, log household events, and optionally send alerts to Telegram. Review and fix the unsafe python3 -c interpolation patterns before running it with real credentials, restrict token and log file permissions, avoid broad cloud-platform credentials where possible, and disable Telegram forwarding unless you explicitly want household activity sent there.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: nest-sdm.sh:77
Finding: Python Source Injection Through CLI Arguments
Content: View full analysis
[name_filter] # name_filter matches against customName or room displayName (case-insensitive, substring) get_device_id() { local dtype="$1" local name_filter="${2:-}" api_get "devices" | python3 -c " import sys, json devices = json.load(sys.stdin).get('devices', []) name_filter = '''${name_filter}'''.strip().lower() matches = [] for d in devices: if d['type'] == 'sdm.devices.types.${dtype}': matches.append(d) if not matches: print(f'Error: No ${dtype} device found.', file=sys.stderr) sys.exit(1) if name_filter: filtered = [] for d in matches: custom = d.get('traits', {}).get('sdm.devices.traits.Info', {}).get('customName', '').lower() room = (d.get('parentRelations', [{}])[0].get('displayName', '') or '').lower() if name_filter in custom or name_filter in room: filtered.append(d) if not filtered: avail = [] for d in matches: custom = d.get('traits', {}).get('sdm.devices.traits.Info', {}).get('customName', '') room = d.get('parentRelations', [{}])[0].get('displayName', '') label = custom or room or '(unnamed)' avail.append(label) print(f'Error: No ${dtype} matching \"{name_filter}\". Available: {\", \".join(avail)}', file=sys.stderr) sys.exit(1) matches = filtered print(matches[0]['name'].split('/')[-1]) " } ``` A related instance occurs at line 414: ```bash echo "✅ Fan ON for ${duration}s ($(python3 -c "print(${duration} ...[truncated 2127 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: nest-events.sh:119
Finding: Remote Pub/Sub Event Data Is Embedded Into Executable Python Source
Content: View full analysis
/dev/null) echo "$decoded" } format_event_alert() { local event_json="$1" python3 -c " import json, sys from datetime import datetime try: event = json.loads('''${event_json}''') except: sys.exit(0) ``` The remote data reaches this function during event processing: ```bash decoded=$(echo "$msg_data" | parse_event) # Format alerts local alerts alerts=$(format_event_alert "$decoded") ``` ### Technical Analysis Pub/Sub message data is controlled by entities with permission to publish to the configured topic. The listener Base64-decodes this remote content and passes it as `event_json`. It then interpolates the decoded value directly into a triple-quoted literal inside a `python3 -c` program. JSON validation occurs only after Python has parsed the generated source code. It therefore cannot prevent source injection. Crafted data containing a suitable triple-quote termination sequence, escaping characters, and additional Python statements can alter the generated program before `json.loads` processes the value. This creates a network-reachable code-execution boundary. The attack does not require direct shell access to the host; it requires the ability to publish a crafted message to the relevant Pub/Sub topic or otherwise cause crafted content to be returned to the subscription. ### Attack Path 1. An attacker obtains or alre ...[truncated 1284 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: nest-sdm.sh:171
Finding: Remote SDM API Responses Are Embedded Into Python Programs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: nest-events.sh:94
Finding: Telegram Message and Configuration Values Are Embedded Into Python Source
Content: View full analysis
/dev/null 2>&1 || echo "[$(date)] Warning: Failed to send Telegram alert" >&2 } ``` ### Technical Analysis The alert message, Telegram chat ID, and parse mode are inserted directly into Python source. Alert text can contain information derived from remote event fields, including resource names. The chat ID may originate from environment variables or text extracted from `~/.zshenv`. A value containing quote delimiters and Python syntax can escape its intended literal and append executable statements. JSON serialization does not mitigate the issue because `json.dumps` is called only after Python parses and begins executing the dynamically constructed program. The Telegram bot token is placed in the request URL, which is necessary for Telegram's Bot API but should be protected from process tracing, verbose logging, and diagnostic output. ### Attack Path 1. An attacker influences a remotely derived alert field or a local Telegram configuration value. 2. `pull_events` formats the value as an alert and calls `send_telegram_alert`. 3. The function interpolates the value into the program passed to `python3 -c`. 4. The crafted value terminates the intended Python string. 5. Injected Python statements ...[truncated 698 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: nest-events.sh:34
Finding: Raw Household Event Logs Are Created Without Explicit Restrictive Permissions
Content: View full analysis
> "${LOG_DIR}/events-$(date +%Y-%m-%d).jsonl" ``` ### Technical Analysis The listener records decoded Pub/Sub events in daily JSONL files. These events may include doorbell activity, person and motion detection, sound detection, thermostat state, timestamps, and device identifiers. The script does not set a restrictive `umask`, explicitly assign directory mode `700`, or assign log mode `600`. Resulting permissions therefore depend on the invoking environment's existing umask. Under a permissive configuration, other local accounts or processes may be able to read the logs. The logs have no documented automated retention or deletion mechanism, which can cause sensitive historical occupancy information to accumulate indefinitely. ### Attack Path 1. The event listener receives and decodes Nest events. 2. It appends every decoded event to a daily log file. 3. A permissive process umask causes the directory or files to be created with group or world-readable permissions. 4. Another local user or compromised process reads the accumulated event files. 5. The reader correlates timestamps and event types to infer household presence, routines, or device activity. ### Impact Assessment Exposure is limited to principals that can access the local filesystem, but the data is privacy-sensitive. Potential consequences include: - Disclosure of doorbell, person, motion, and sound detection history. - Occupancy and routine inference. - Exposure of device and resource identifiers. - Long-term accumulation of household activity data. - Increased impact from a ...[truncated 122 chars]
Remediation: View remediation
> "$log_file" ``` - Document what data is retained and obtain explicit user consent. - Implement configurable retention, rotation, and secure deletion. - Consider logging only the minimum fields required for diagnostics rather than complete raw events. - Avoid logging authentication tokens, image URLs, stream tokens, or other credentials if they appear in future event schemas. - Protect the workspace against access by unrelated local accounts and processes. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest says the skill controls Nest devices, but the documentation also describes polling Pub/Sub, modifying IAM permissions, logging events, and forwarding alerts to Telegram. That mismatch is dangerous because users may authorize a device-control skill without realizing it also monitors household activity, stores event data, and transmits it to external services.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-events.sh (reported line 62)May include surrounding context.
sh
refresh_token=$(python3 -c "import json; print(json.load(open('${tokens_file}'))['refresh_token'])") local response token response=$(curl -s -X POST https://oauth2.googleapis.com/token \ -d "client_id=${client_id}" \ -d "client_secret=${client_secret}" \ -d "refresh_token=${refresh_token}" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-events.sh (reported line 251)May include surrounding context.
sh
token=$(get_pubsub_token) || return 1 local response response=$(curl -s -X POST \ "https://pubsub.googleapis.com/v1/projects/${GCP_PROJECT}/subscriptions/${PUBSUB_SUBSCRIPTION}:pull" \ -H "Authorization: Bearer ${token}" \ -H "Content-Type: application/json" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-events.sh (reported line 338)May include surrounding context.
sh
echo "Creating Pub/Sub topic: projects/${GCP_PROJECT}/topics/${PUBSUB_TOPIC}" local response response=$(curl -s -X PUT \ "https://pubsub.googleapis.com/v1/projects/${GCP_PROJECT}/topics/${PUBSUB_TOPIC}" \ -H "Authorization: Bearer ${token}" \ -H "Content-Type: application/json" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-events.sh (reported line 365)May include surrounding context.
sh
echo "Creating subscription: projects/${GCP_PROJECT}/subscriptions/${PUBSUB_SUBSCRIPTION}" local response response=$(curl -s -X PUT \ "https://pubsub.googleapis.com/v1/projects/${GCP_PROJECT}/subscriptions/${PUBSUB_SUBSCRIPTION}" \ -H "Authorization: Bearer ${token}" \ -H "Content-Type: application/json" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-events.sh (reported line 402)May include surrounding context.
sh
# Get current IAM policy local policy policy=$(curl -s -X GET \ "https://pubsub.googleapis.com/v1/${topic_path}:getIamPolicy" \ -H "Authorization: Bearer ${token}" 2>/dev/null)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-events.sh (reported line 449)May include surrounding context.
sh
set_policy=$(echo "$new_policy" | python3 -c "import sys,json; print(json.dumps(json.load(sys.stdin).get('policy', {})))" 2>/dev/null) local result result=$(curl -s -X POST \ "https://pubsub.googleapis.com/v1/${topic_path}:setIamPolicy" \ -H "Authorization: Bearer ${token}" \ -H "Content-Type: application/json" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-sdm.sh (reported line 39)May include surrounding context.
sh
# --- Auth --- get_token() { local response response=$(curl -s -X POST https://oauth2.googleapis.com/token \ -d "client_id=${CLIENT_ID}" \ -d "client_secret=${CLIENT_SECRET}" \ -d "refresh_token=${REFRESH_TOKEN}" \

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · nest-sdm.sh (reported line 49)May include surrounding context.
sh
token=$(echo "$response" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('access_token',''))" 2>/dev/null) if [ -z "$token" ]; then echo "Error: Failed to get access token. Response:" >&2 echo "$response" >&2 echo "" >&2 echo "The refresh token may have expired (7-day limit in testing mode)." >&2

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-sdm.sh (reported line 64)May include surrounding context.
sh
# --- API helpers --- api_get() { curl -s -X GET "${BASE_URL}/$1" \ -H "Authorization: Bearer ${ACCESS_TOKEN}" \ -H "Content-Type: application/json" }

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · nest-sdm.sh (reported line 561)May include surrounding context.
sh
if url: print(f'Image URL: {url}') print(f'Token: {token[:40]}...') print(f'Download: curl -o ${output} -H \"Authorization: Basic {token}\" \"{url}\"') else: err = r.get('error', {}) print(f'Error: {err.get(\"message\", \"Unknown error\")}')

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents shell-based capabilities and operational commands but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where a user or platform may not understand that the skill can invoke shell actions with side effects, increasing the chance of unintended command execution or overbroad access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented capabilities materially exceed the manifest description by including event polling, local logging, and third-party alerting. In security terms, incomplete disclosure undermines informed consent and can hide sensitive data flows involving occupancy, motion, and camera-related metadata.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
### Prerequisites 1. **Device Access Console** — Register at https://console.nest.google.com/device-access ($5 one-time fee) 2. **GCP Project** — Create at https://console.cloud.google.com with SDM API enabled 3. **OAuth Client** — Web application type with `https://www.google.com` as redirect URI 4. **SDM scope** — Add `https://www.googleapis.com/auth/sdm.service` to OAuth consent screen

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Copy the code= parameter from the redirect URL

Exchange for tokens:

bash
curl -s -X POST https://oauth2.googleapis.com/token \ -d "client_id=<CLIENT_ID>" \ -d "client_secret=<CLIENT_SECRET>" \ -d "code=<AUTH_CODE>" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to persist OAuth client secrets and refresh tokens locally but does not explicitly warn that these credentials grant ongoing access to smart-home devices and related data. If the file is exposed, an attacker could gain durable access to device control and monitoring capabilities, including cameras and thermostat functions.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
"scope": "https://www.googleapis.com/auth/sdm.service" }

text
Secure it: `chmod 600 ~/.openclaw/workspace/.nest-sdm-tokens.json` ## CLI Usage

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill enables live camera streaming and event snapshot retrieval without warning users about the privacy implications of accessing in-home video and image data. In a home automation context, camera feeds are highly sensitive and misuse could expose occupants, routines, and private spaces.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Telegram alerting is not necessary for the stated core function of controlling Nest devices and introduces third-party data transmission of sensitive home activity events. Because alerts may contain occupancy or motion information, this broadens the privacy and attack surface beyond what a user would expect from a control-only skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The event listener features describe storing raw smart-home events locally and forwarding alerts to Telegram without an explicit warning that household activity data may be retained and transmitted to a third party. Motion, person, sound, and doorbell events can reveal presence patterns and other sensitive behavioral information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill materially expands scope beyond Nest device control by adding event forwarding to Telegram and Google Cloud Pub/Sub topic/subscription/IAM management. This increases the attack surface and introduces data-flow and infrastructure-changing capabilities that are not implied by simple local device control, making accidental over-privilege and privacy leakage more likely.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The script is designed to create persistent Pub/Sub resources and use long-lived OAuth refresh tokens, establishing ongoing access and durable event-delivery channels. That persistence is not inherently malicious, but it does increase exposure if credentials or configuration are later compromised.
Content: Scanner excerpt · nest-events.sh (reported line 10)May include surrounding context.
sh
# nest-events.sh listen - Poll events continuously (daemon mode) # nest-events.sh poll - Poll once, print events, exit # nest-events.sh setup-check - Verify Pub/Sub config is ready # nest-events.sh create-topic - Create Pub/Sub topic (requires cloud-platform scope) # nest-events.sh create-subscription - Create pull subscription # nest-events.sh grant-permissions - Grant SDM publisher role to topic #

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · nest-events.sh (reported line 62)May include surrounding context.
sh
refresh_token=$(python3 -c "import json; print(json.load(open('${tokens_file}'))['refresh_token'])") local response token response=$(curl -s -X POST https://oauth2.googleapis.com/token \ -d "client_id=${client_id}" \ -d "client_secret=${client_secret}" \ -d "refresh_token=${refresh_token}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: The Telegram API endpoint is used to transmit device event notifications off-system. In a home monitoring context, that external transmission is sensitive because it can disclose presence, movement, and other behavioral signals to a third party.
Content: Scanner excerpt · nest-events.sh (reported line 102)May include surrounding context.
sh
return 0 fi curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d "$(python3 -c " import json, sys

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: The Telegram API endpoint is used to transmit device event notifications off-system. In a home monitoring context, that external transmission is sensitive because it can disclose presence, movement, and other behavioral signals to a third party.
Content: Scanner excerpt · nest-events.sh (reported line 102)May include surrounding context.
sh
return 0 fi curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d "$(python3 -c " import json, sys

Static analysis

No suspicious patterns detected.