Security audit

Feyagate

Security checks across malware telemetry and agentic risk

Overview

FeyaGate is a coherent smart-home gateway, but it exposes high-impact device, camera, credential, network, memory, and skill-management controls with weak documented scoping and safeguards.

Review this carefully before installing. Only run it on a trusted machine and network, avoid pipe-to-shell install unless you have verified the script and package source, bind the service to localhost if possible, and do not provide smart-home passwords, OAuth codes, API keys, camera access, endpoint changes, skill-management actions, or memory changes unless you explicitly intend those effects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documented API includes full skill lifecycle management (`skill/create`, `skill/update`, `skill/delete`, `skill/read`, `skill/context`) even though the product is presented as a smart-home gateway. That expands the trust boundary from device control into arbitrary agent-behavior modification, which can be abused to implant prompt-injection content, alter agent behavior persistently, or expose sensitive skill contents.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The specific endpoints for creating, updating, deleting, reading, and reloading skills give remote callers the ability to change what the agent sees and does, which is far more powerful than ordinary smart-home control. In the context of an AI-integrated gateway, this can become a code/prompt supply-chain vector that enables persistent prompt injection, exfiltration instructions, or unauthorized automation logic.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented API exposes a full skill-management surface that can read, create, update, delete, and reload arbitrary skills, which materially expands the trust boundary beyond normal smart-home control. In an agent setting, this enables persistence, prompt/context manipulation, and potentially indirect code or workflow execution through adversarial skill content, making it a real capability-expansion risk.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Allowing user-supplied outbound WebSocket endpoints lets an agent direct the gateway to connect to arbitrary remote systems, creating SSRF-like egress, data exfiltration, and remote control channels unrelated to core device management. In a smart-home gateway, this is especially dangerous because the service has access to sensitive device state and may bridge tools to the remote peer.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The API documents camera snapshot and Vision AI analysis that send recent frames and user queries to an external LLM service, but it does not clearly warn about capture and third-party transmission of potentially sensitive home imagery. This creates a meaningful privacy and consent risk in a smart-home context where images may include occupants, interiors, and routines.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The documentation instructs users to provide account passwords and API keys for third-party platforms without clear warnings about secret handling, storage, masking, and logging practices. In an agent-integrated gateway, missing guidance increases the risk of credential exposure through prompts, logs, screenshots, or over-broad tool access.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The guide recommends one-line install commands that fetch remote code and immediately execute it via `bash` or PowerShell, without any warning or verification step. This creates a real supply-chain risk: if the hosted script or distribution path is compromised, users may run arbitrary code on their systems with minimal scrutiny.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The credential-based authorization examples submit usernames/emails and passwords to the local MCP service, but the guide provides no privacy or trust warning before asking users to do so. In a skill intended for AI agents and smart-home control, this omission is dangerous because users may expose high-value home automation credentials to a locally running service they have not independently validated.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The camera snapshot section instructs users to connect to cameras and capture images without any privacy notice or consent guidance. Because this skill targets smart-home devices, camera access is especially sensitive and could expose private spaces or occupants if used carelessly or by a compromised agent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The sub-skill triggers include very broad terms such as "camera," "speaker," "switch," "relay," and generic automation words, which can cause the smart-home control skill to activate in unrelated conversations. In this context, unintended activation is more dangerous than usual because the skill can control physical devices, cameras, and home automation state, potentially leading to privacy impact or unauthorized actions if an agent routes a request incorrectly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documentation presents installation and control workflows for smart-home devices but does not prominently warn that tool use can affect real-world devices, audio systems, cameras, and household state. In a smart-home gateway context, this omission increases the chance that users or agents invoke tools without understanding physical safety, privacy, or disruption risks.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill description advertises broad 'Automation tools' capability spanning scheduling, triggering, room management, memory, and skill management without stating any user-confirmation, authorization, or contextual trigger constraints. In an agent setting, this increases the chance the skill is invoked for sensitive state-changing actions too freely, enabling unintended persistence, automation, or configuration changes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The memory tools allow reading all long-term memories and adding, updating, or deleting entries, but the markdown provides no warning that data is persistent or that delete/update operations can irreversibly alter stored information. For an AI agent, this creates a real risk of privacy exposure, silent retention of sensitive data, and accidental destruction or poisoning of memory state.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill system exposes add/update/delete management operations that can modify available skills and therefore alter future agent behavior, but the documentation does not warn that these are administrative, high-risk actions. In this context, the danger is elevated because changing skill definitions can persistently expand capabilities, weaken safeguards, or introduce malicious behavior through the agent's own toolchain.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill exposes write-capable device control operations such as setting properties and executing actions for smart-home devices without an explicit warning that these commands can change physical device state. In an agent context, this increases the risk of unintended or unsafe actuation of switches or appliances, especially if the user does not realize these are live control operations.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The documentation exposes tools that can change license state and update persisted configuration, including sensitive values like API keys, without any warning about side effects or credential handling. In an agent-skill context, this increases the chance an LLM or user invokes these operations casually, leading to unwanted configuration drift, credential overwrites, service disruption, or leakage of stored secrets through follow-on actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The `xiaozhi/set_endpoint` tool allows changing the WebSocket endpoint to a user-supplied URL, effectively redirecting network communication to an arbitrary remote service. Without a clear warning, an agent may treat this as routine configuration, enabling SSRF-like behavior, exfiltration of device or session data, loss of integrity of AI interactions, or connection to attacker-controlled infrastructure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs users to provide full Midea/Meiju account credentials and discusses token lifetime, but it does not warn that these are sensitive secrets that must not be logged, echoed, stored insecurely, or shared with other tools. In an agent setting, this increases the risk of credential exposure and subsequent unauthorized cloud access to the user's appliances and account data.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The device-control section provides direct instructions for changing appliance properties and executing actions on real devices without a warning that these operations have physical effects. In a smart-home context, an agent could alter AC or appliance state unexpectedly, causing safety, comfort, energy, or operational issues if invoked without clear confirmation and guardrails.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents camera snapshot capture and AI vision analysis capabilities without any explicit privacy or consent warning, even though these features can collect sensitive images from inside a home. In a smart-home agent context, normalizing image capture without user confirmation increases the risk of unauthorized surveillance, over-collection, and accidental analysis of private spaces.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The OAuth section walks through obtaining an auth URL, logging in, extracting a code, and submitting it, but does not warn that the flow handles highly sensitive authorization artifacts tied to a Xiaomi account. In an agent-operated skill, this omission can lead users or downstream systems to expose auth codes or tokens in logs, chat transcripts, shell history, or insecure handling paths.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.