Feyagate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.9

Overview

This smart-home gateway skill is clearly about device control, but it combines unsafe auto-install instructions, broad network exposure, camera/account access, and persistent agent-state changes that need review before use.

Install only after reviewing the installer and binary source, prefer pinned versions with checksums, and do not let an agent run the AUTO one-line install unattended. Run the gateway on localhost only, keep it behind a firewall, avoid entering account passwords over non-loopback HTTP, and treat camera/Vision AI, schedules, memory, and skill-management tools as admin-only actions requiring explicit approval.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: QUICKSTART.md:14
• Finding: Automatic Execution of Mutable Remote Installation Scripts<![CDATA[ ## Vulnerability Details **File Location**: `QUICKSTART.md`, lines 14-33 **Vulnerability Type**: Remote payload retrieval and direct shell execution **Risk Level**: Critical ### Vulnerable Code ```markdown > Steps marked with **[AUTO]** can be executed without asking the user. > Steps marked with **[ASK]** require user input before proceeding. ## One-Line Install [AUTO] **macOS / Linux** — installs the Python package and MCP server binary in one step: ```bash curl -fsSL https://raw.githubusercontent.com/toddpan/feyagate-skill/main/scripts/install.sh | bash ``` **Windows (PowerShell):** ```powershell iwr -useb https://raw.githubusercontent.com/toddpan/feyagate-skill/main/scripts/install.ps1 | iex ``` ``` ### Technical Analysis The installation instructions download mutable content from the `main` branch of a personal GitHub repository and immediately pass it to Bash or PowerShell. The effective code executed on a user's system can therefore change after this Skill has been reviewed. Neither installation path pins an immutable commit, verifies a cryptographic signature, checks a published digest, nor lets the user inspect the downloaded file before execution. The `-s`/`-fsSL` and `-useb` options also make this a streamlined, noninteractive execution flow. The risk is amplified by labeling the installation step as `[AUTO]` and explicitly stating that an AI assistant may execute it without asking the user. Installation of a smart-home gateway may be legitimate, but unattended execution of an unverified remote script is not the minimum privilege necessary to perform that installation. The actual remote scripts are not included in the audited artifact. Consequently, their current or future behavior—including downloaded binaries, filesystem modifications, persistence, credential access, and network activity—cannot be verified by this audit. ### Attack Path 1. An attacker compromises the GitHub account, repository, branch, or content delivery pat ...[truncated 1181 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands and do not mark installation as automatic. 2. Require explicit, informed user approval before downloading or executing any installer. 3. Publish installers as versioned release assets rather than retrieving them from a mutable branch. 4. Pin the installer to an immutable commit or release version. 5. Publish a SHA-256 digest and preferably a detached signature from a documented release key. 6. Use a staged procedure: ```bash curl -fL -o install.sh "<immutable-release-url>" sha256sum -c install.sh.sha256 less install.sh bash install.sh ``` 7. Apply the equivalent download, signature verification, inspection, and execution separation on Windows. 8. Include the installer source in the audited Skill artifact or link it to an immutable revision so reviewers can verify its behavior. 9. Document every file, executable, service, and network endpoint the installer creates or contacts. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:128
• Finding: Privileged Smart-Home API Is Documented Without Caller Authentication and Binds to All Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 128-138; `FeyaGate_HTTP_API.md`, lines 4-6; `FeyaGate_MCP_API.md`, lines 39-55 and 224-303 **Vulnerability Type**: Missing access control on a high-privilege network service **Risk Level**: Critical ### Vulnerable Code From `SKILL.md`: ```yaml server: http_port: 38080 ws_port: 8765 bind_address: "0.0.0.0" auth: cloud_server: "cn" # cn / de / sg / us / ru / i2 ``` From `FeyaGate_HTTP_API.md`: ```markdown > **Base URL**: `http://<gateway-IP>:<port>` (desktop default `38080`) > **Protocol**: HTTP REST + MCP JSON-RPC 2.0 > **CORS**: Globally permits `Access-Control-Allow-Origin: *` ``` The audited file expresses these lines in Chinese; the English rendering above preserves their documented meaning. From `FeyaGate_MCP_API.md`: ```bash curl -X POST http://localhost:38080/mcp/http \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"MyClient","version":"1.0.0"}}}' curl -s -X POST http://localhost:38080/mcp/http \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' ``` The same document states that HTTP calls require no prior handshake and that the server is stateless and issues no session identifier. No authorization header, access token, client certificate, or permission scope is documented for privileged tool calls. The exposed catalog includes, among other operations: ```text set_xiaomi_device_property execute_xiaomi_device_action xiaomi/scene_trigger xiaomi/camera_connect xiaomi/camera_snapshot xiaoai/tts xiaoai/control auth/midea_login auth/midea_logout auth/ewelink_login auth/ewelink_logout set_midea_device_property set_ewelink_device_property trigger/create schedule/add skill/create skill/update config/set_vision license/set license/clear ``` ### Technical Analysis Binding the service to `0.0 ...[truncated 3009 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the default bind address to `127.0.0.1` and `::1`. 2. Require an explicit security warning and configuration action before permitting non-loopback binding. 3. Require strong, randomly generated per-client credentials for every API request. 4. Support mutually authenticated TLS or another secure local transport for non-loopback clients. 5. Implement granular authorization scopes, separating: - Device reading - Device control - Camera access - Credential management - Configuration administration - Skill and memory administration 6. Require interactive confirmation for camera capture, account login/logout, skill mutation, external endpoint changes, and safety-sensitive physical actions. 7. Restrict CORS to an explicit allowlist of trusted origins. Do not use `Access-Control-Allow-Origin: *` for administrative APIs. 8. Reject plaintext credential submission over non-loopback HTTP. 9. Add rate limiting, request-size limits, replay protection where applicable, and tamper-evident audit logs. 10. Document firewall requirements and ensure the setup command does not automatically expose port 38080 externally. 11. Add automated tests proving that anonymous callers cannot invoke either read or write tools. ]]>

T02 · Agent Memory Poisoning

Error

• Location: FeyaGate_HTTP_API.md:1038
• Finding: Persistent Agent Skills, Memory, and Recurring Actions Can Be Mutated Through the Gateway<![CDATA[ ## Vulnerability Details **File Location**: `FeyaGate_HTTP_API.md`, lines 1038-1085; `skills/automation.md`, lines 17-79 **Vulnerability Type**: Persistent Agent-state and instruction poisoning **Risk Level**: High ### Vulnerable Code From `FeyaGate_HTTP_API.md`: ```markdown ### 14.3 skill/create Create a new custom skill. | Parameter | Type | Required | Description | | `name` | string | Yes | Skill name | | `content` | string | Yes | Skill content (Markdown + YAML frontmatter) | ### 14.4 skill/update Update existing custom skill content. | Parameter | Type | Required | Description | | `name` | string | Yes | Skill name | | `content` | string | Yes | New skill content | ### 14.5 skill/delete Delete the specified custom skill. ### 14.6 skill/context Retrieve the context content of all persistent skills. ### 14.7 skill/reload Rescan the skill directory and refresh the cache. ``` The audited file expresses these descriptions in Chinese; the English rendering above preserves their documented meaning. From `skills/automation.md`: ```markdown ## Schedule | Tool | Arguments | Returns | |------|-----------|---------| | `schedule/add` | `name`, `scheduledTime`, `toolName`, `toolArgs`, `repeat`, `repeatDays` (opt) | Task ID | | `schedule/list` | — | `tasks[]` | | `schedule/get` | `id` | Task detail | | `schedule/update` | `id` + fields to update | Update result | | `schedule/delete` | `id` | Delete result | | `schedule/cancel` | `id` | Cancel result | ## Memory System | Tool | Arguments | Returns | |------|-----------|---------| | `memory/read` | — | All long-term memories | | `memory/add` | `content`, `category` (opt) | Added entry | | `memory/update` | `id`, `content` | Update result | | `memory/delete` | `id` | Delete result | | `memory/search` | `keyword` | Matching entries | | `memory/note` | `content` | Add today's note | | `memory/today` | — | Today's notes | ## Skill System | Tool | Arguments | Returns | |------|-----------|-------- ...[truncated 3141 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict all memory, Skill, and schedule mutations to a separately authenticated administrative role. 2. Require explicit local user confirmation before: - Creating or updating a Skill - Reloading Skill context - Adding or changing long-term memory - Creating a recurring action 3. Treat custom Skill and memory content as untrusted data, not as system-level instructions. 4. Apply strict provenance labels and clearly distinguish built-in, administrator-approved, and untrusted content. 5. Validate Skill frontmatter against a narrow schema and reject unsupported instruction-bearing fields. 6. Prevent custom Skills from changing safety constraints or silently invoking sensitive tools. 7. Restrict scheduled tasks to an allowlist of low-risk tools and validated argument schemas. 8. Require renewed authorization for camera, lock, GPIO, credential, or other high-impact scheduled actions. 9. Maintain tamper-evident logs containing the caller identity, timestamp, old value, new value, and approval record. 10. Add version history, rollback, ownership controls, and integrity hashes for all persistent Skills and memories. 11. Never automatically load externally written content into trusted Agent context. ]]>

T08 · Insecure Dependencies

Error

• Location: QUICKSTART.md:40
• Finding: Unpinned Python Package and Unverifiable Downloaded Server Binary<![CDATA[ ## Vulnerability Details **File Location**: `QUICKSTART.md`, lines 40-74 **Vulnerability Type**: Unpinned and unverifiable software supply chain **Risk Level**: High ### Vulnerable Code ```markdown ## Step 1: Install [AUTO] **Option A — from PyPI (standard online install):** ```bash pip install feyagate-skill ``` **Option B — from source (developers / contributors):** ```bash git clone https://github.com/toddpan/feyagate-skill.git cd feyagate-skill pip install -e ".[dev]" # includes pytest and other dev dependencies ``` Verify: ```bash feyagate --version ``` ## Step 2: Setup & Start [AUTO] Download and install the MCP server binary (may take 1-2 minutes): ```bash feyagate setup ``` ``` ### Technical Analysis The standard installation command requests the latest available `feyagate-skill` package without an exact version or package hash. The source installation similarly clones the mutable default repository branch rather than a signed tag or immutable commit. After installation, `feyagate setup` downloads an approximately 30 MB native server binary. The documentation does not identify the exact artifact URL, expected version, cryptographic digest, signing identity, or verification procedure. The executable and downloader implementation are absent from the audited project, so their actual behavior cannot be examined. Checking `feyagate --version` only reports what the installed executable claims; it does not establish authenticity or integrity. This chain therefore delegates execution trust to several mutable components: the package registry entry, transitive dependencies, repository branch, setup implementation, and binary distribution endpoint. ### Attack Path 1. An attacker compromises the PyPI project, maintainer credentials, repository, dependency chain, or server-binary hosting location. 2. The attacker publishes a malicious package version or replaces the binary downloaded by `feyagate setup`. 3. The AI assistant runs the `[A ...[truncated 1113 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Python package to an exact reviewed version: ```bash pip install "feyagate-skill==<reviewed-version>" --require-hashes ``` 2. Publish and use a hash-locked requirements file for all transitive dependencies. 3. Clone an immutable commit or verified signed release tag instead of the default branch. 4. Publish the server binary as a versioned release artifact with: - SHA-256 or stronger digest - Detached cryptographic signature - Documented signing key - Platform and architecture metadata 5. Make `feyagate setup` fail closed when signature or digest verification fails. 6. Display the exact binary source, version, digest, and destination before installation. 7. Require user confirmation before downloading or replacing an executable. 8. Publish the server source and reproducible-build instructions so users can verify that release binaries correspond to reviewed source. 9. Include the setup/downloader implementation in the audited project. 10. Avoid automatic updates to mutable “latest” artifacts; require version selection, verification, and rollback support. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (77)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### 清除授权

```
DELETE /api/v1/gateway/license
```

**响应示例**:

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Self-modifying capabilities are especially risky in an MCP service because they let an agent rewrite its own future behavior by changing skill content. That creates a persistence mechanism for prompt injection, policy bypass, hidden data exfiltration instructions, or later device actions that are not visible in the original request flow.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The quick-start explicitly instructs AI agents to fetch and execute remote shell/PowerShell installer scripts via `curl|bash` and `iex`. This grants arbitrary code execution on the host from mutable remote content, which is especially dangerous because the document marks it as safe for autonomous execution by agents.

Chaining Abuse

High

• Category: Tool Misuse

Content

**macOS / Linux** — installs the Python package and MCP server binary in one step:

```bash
curl -fsSL https://raw.githubusercontent.com/toddpan/feyagate-skill/main/scripts/install.sh | bash
```

**Windows (PowerShell):**

• Confidence: 99% confidence
• Finding: Piping the output of a network fetch directly into `bash` is a classic dangerous chaining pattern that combines retrieval and execution without review. If the remote content is modified, intercepted, or the source account is compromised, the host can be fully compromised immediately.

External Script Fetching

High

• Category: Supply Chain

Content

Requires Tuya Smart or Smart Life app. User Code location: **Me → Settings → Account & Security → User Code**.

```bash
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"auth/tuya_qr","arguments":{"user_code":"USER_CODE"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

### Midea (Password Login)

```bash
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"auth/midea_login","arguments":{"account":"PHONE_OR_EMAIL","password":"PASSWORD"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

### eWeLink (Password Login)

```bash
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"auth/ewelink_login","arguments":{"email":"EMAIL","password":"PASSWORD","country_code":"+86"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

### Verify Authorization

```bash
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"auth/platforms","arguments":{}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

## Usage Examples

> These examples show how to use the MCP tools via curl.
> When using through an AI agent, the agent calls these tools automatically — no curl needed.

### List & Search Devices

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Search by keyword
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"device/list","arguments":{"filter":["living room","light"]}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Filter by platform
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"device/list","arguments":{"filter":[],"platform":"xiaomi"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Query device spec
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"device/specs","arguments":{"deviceId":"YOUR_DID"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Read property
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"xiaomi/get_properties","arguments":{"device_id":"YOUR_DID","siid":2,"piids":[1]}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Set property (turn on light)
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"xiaomi/set_property","arguments":{"device_id":"YOUR_DID","siid":2,"piid":1,"value":true}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Execute action
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"xiaomi/execute_action","arguments":{"device_id":"YOUR_DID","siid":2,"aiid":1}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# List scenes
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"scene/list","arguments":{"platform":"xiaomi"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Trigger scene
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"scene/trigger","arguments":{"platform":"xiaomi","sceneId":"SCENE_ID"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# TTS broadcast
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"xiaoai/tts","arguments":{"device_id":"SPEAKER_DID","text":"Hello, welcome home"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Play music
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"xiaoai/play_music","arguments":{"device_id":"SPEAKER_DID","text":"Play some pop music"}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -m json.tool

# Voice control (silent mode)
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"xiaoai/control","arguments":{"device_id":"SPEAKER_DID","command":"turn on the living room light","silence":true}}}' \
  | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

feyagate snapshot --camera-id CAMERA_DID --connect --count 3

# API: connect → wait → snapshot → disconnect
curl -s -X POST http://localhost:38080/mcp/http \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"xiaomi/camera_connect","arguments":{"camera_id":"CAMERA_DID"}}}'
# Wait 3-5 seconds for P2P connection

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes capturing camera frames and sending visual content to Vision AI but does not prominently warn that private images and scene details may leave the local environment and be processed by external services. In a smart-home context, this is especially sensitive because camera data can reveal occupants, routines, and interiors.

Context-Inappropriate Capability

Medium

• Confidence: 74% confidence
• Finding: A camera snapshot option that switches to subprocess-based execution signals a potentially dangerous execution path without documenting strict constraints on what is invoked. In a system already handling device and camera inputs, subprocess invocation increases the risk of command execution bugs or abuse if arguments or downstream components are not tightly controlled.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documented configuration and deletion-style operations can change persistent system behavior or remove settings, but the document does not flag them as security-sensitive or system-affecting. In an agent-operated gateway, lack of warning increases the chance of accidental or unauthorized destructive changes with operational and privacy consequences.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The API includes Vision AI configuration, external model endpoint settings, and token-usage analytics that go beyond basic smart-home control and introduce outbound data flow to third-party AI services. Because camera-derived content may be analyzed externally and API endpoints can be reconfigured, this increases the risk of privacy leakage, data exfiltration, and misuse of stored AI credentials.

Static analysis

No suspicious patterns detected.