智能灯控(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a local smart-light controller, but its broad permissions and unrelated trigger instructions make its scope unclear enough to require review before installation.

Install only if you are comfortable giving the agent local command execution plus broad file read/write authority. Use it only for Kasa smart-light tasks, avoid invoking it for analytics or reporting work, and prefer installing dependencies in a dedicated virtual environment with reviewed pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:112

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 112–121 and 239–240
Vulnerability Type: Insecure dependency installation and insufficient supply-chain integrity controls
Risk Level: Medium

Vulnerable Code Snippets

markdown

- Installed uv package manager (`pip install uv` or `brew install uv`)

bash

uv pip install python-kasa>=0.10.2

markdown

| python-kasa | Python library | Required | `uv pip install python-kasa>=0.10.2` |
| uv | Package manager | Recommended | `pip install uv` or `brew install uv` |

Technical Analysis

The Skill instructs the agent to install uv without a version constraint and python-kasa using only a lower-bound constraint. It provides no lockfile, package hashes, trusted-index configuration, or other integrity verification.

Consequently, the versions installed depend on mutable package repository state at execution time. A future compromised, malicious, or unexpectedly incompatible release satisfying python-kasa>=0.10.2 could be selected. Package installation and subsequent imports may execute package-controlled code with the privileges of the account running the agent.

This finding concerns missing dependency integrity controls. The audit did not establish that the named packages or their current releases are malicious.

Attack Path

1. An attacker compromises a permitted future release of uv or python-kasa, or otherwise influences the package source used by the environment.
2. An agent follows the instructions in SKILL.md.
3. The package manager resolves the unconstrained or broadly constrained dependency from the mutable source.
4. Installation hooks or imported runtime code execute under the agent account.
5. The malicious dependency accesses resources available to that account or manipulates the Skill's local-network operations.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user or agent performing installa ...[truncated 334 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact, reviewed version, including uv and python-kasa.
2. Generate and commit a lockfile containing cryptographic hashes for all direct and transitive dependencies.
3. Require hash verification during installation and reject artifacts whose hashes do not match the reviewed lockfile.
4. Configure an explicit trusted package index or an internally controlled package mirror rather than relying on ambient package-manager configuration.
5. Install dependencies inside a dedicated virtual environment or sandbox under a non-privileged account.
6. Review dependency updates before changing pinned versions, including package provenance, release history, and transitive dependency changes.
7. Separate installation from device-control execution where practical, and restrict filesystem, environment-variable, and network access to the minimum required for local smart-light control.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger conditions say to use the skill for data analysis, report generation, statistical insight, and visualization, which are unrelated to smart-light control. Overbroad and mismatched triggers can cause the agent to invoke a skill with exec, read, and write privileges in contexts where users did not intend device or system actions, expanding the opportunity for misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The invocation guidance is unrelated to the skill’s stated purpose and is broad enough to match many normal user requests. In practice, this can route unrelated tasks into a skill that has local execution and file capabilities, creating an unsafe privilege crossover from ambiguous prompting rather than explicit user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A local smart-bulb controller may reasonably need command execution, but broad read and write capabilities are not justified by the documented function and violate least privilege. If the skill is invoked under misleading or ambiguous conditions, those permissions could be used to inspect or modify arbitrary local files unrelated to lighting control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill describes commands that directly control physical devices on the local network but does not clearly warn that execution changes real device state immediately. Lack of a safety notice can cause accidental actuation, surprising users or triggering undesirable environmental effects, especially in automated or unattended contexts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims to be a narrowly scoped local smart-light controller, but these sections define generic parameterized workflow behavior (input_params, config_options, output_format) that is not specific to bulb control. This mismatch can conceal broader operational behavior from users and reviewers, increasing the chance that the agent is invoked for unintended tasks under a trusted device-control label.

Content

No source excerpt is available for this finding.