Security audit

宜家灯泡控制工具

Security checks for vulnerabilities and agentic risk

Overview

This skill is for smart-bulb control, but it asks for broad read, write, and command-execution authority and describes generic capabilities beyond that purpose.

Review this before installing. Use it only if you are comfortable giving a smart-home skill command execution plus file read/write authority, and only in an agent environment where those tools can be constrained or manually approved. Prefer a version that limits execution to specific bulb-control operations and clearly documents credential handling and remote-access protections.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a smart-bulb controller, but later claims broad file handling, API integration, search, and command-execution capabilities that are unrelated to that purpose. This mismatch expands the effective authority and makes it easier for the skill to be invoked or trusted for actions far beyond device control, increasing the risk of misuse or privilege abuse in an agent environment.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Advertising command execution in a skill meant for controlling light bulbs is unjustified and dangerous because it can enable arbitrary or loosely constrained system actions under the cover of an innocuous automation tool. In an agent platform with exec support, this creates a direct path to command abuse, lateral actions on the host, or unintended destructive operations if the model is prompted improperly.

Context-Inappropriate Capability

Low

Confidence: 79% confidence
Finding: Generic file read/write capability is broader than needed for bulb control and can expose local data or modify host files if the skill is invoked in unexpected contexts. While not as immediately dangerous as command execution, unnecessary file access increases the blast radius of prompt mistakes, confused-deputy behavior, or malicious tasking.

Context-Inappropriate Capability

Low

Confidence: 77% confidence
Finding: Claiming generic search and information-retrieval capabilities unrelated to bulb control makes the skill overly broad and more likely to be selected for unrelated tasks. This increases the chance that the agent uses the skill as a general-purpose data-access tool, potentially exposing unnecessary information or combining with other overbroad permissions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation guidance says the skill should be used broadly in AI model calling, agent orchestration, and LLM application contexts, rather than only when controlling supported bulbs. Overly broad routing language can cause the agent to select this skill in unrelated scenarios, which is especially risky because the skill also advertises exec, file, and API capabilities.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The documentation promotes remote control of smart bulbs without a clear warning about privacy, network exposure, and the real-world effects of device manipulation. Because this is a physical-world control skill, users should be explicitly informed about risks such as unauthorized remote access, occupancy inference, and unintended device activation.

Static analysis

No suspicious patterns detected.