Dyson Fan Control

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Dyson device-control skill, but it requires trusting a local CLI that logs into Dyson, stores device credentials, and can change fan or heater settings.

Install only from a trusted or pinned source, run `dyson setup` only if you are comfortable entering Dyson account credentials, protect `~/.dyson/config.json`, and use clear prompts when changing power or heating settings.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked incorrectly, the agent could turn a device on or off, change fan speed, or enable heating.

Why it was flagged

The skill exposes commands that can change the state of a physical Dyson fan/heater. This is expected for the skill, but users should be aware that invocations can affect comfort, energy use, and heating behavior.

Skill content

dyson on ... dyson off ... dyson heat on ... dyson heat target 22

Recommendation

Use the skill only for explicit Dyson-control requests, and confirm heating or power changes when the impact matters.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone with access to the saved credential file may be able to control configured Dyson devices on the local network.

Why it was flagged

Setup prompts for Dyson account authentication and saves device credentials locally. This is disclosed and necessary for local device control, but it is still sensitive account/device authority.

Skill content

password = click.prompt("Enter your Dyson account password", hide_input=True) ... "credential": device.credential ... save_config(config)

Recommendation

Run setup only from a trusted install, keep `~/.dyson/config.json` private, and remove the config if you no longer use the skill.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing directly from a moving remote repository could install code different from the reviewed artifact if the repository changes.

Why it was flagged

The documented install path pulls code from a GitHub repository rather than a pinned release in the provided registry install spec. This is a common manual CLI installation pattern, but users should verify the source.

Skill content

pip install git+https://github.com/tmustier/dyson-cli.git

Recommendation

Prefer a reviewed release, pinned commit, or trusted package source before installing and running setup.