Security audit

MiGPT Xiaomi Assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly documentation for a Xiaomi MiGPT setup, but it includes high-risk instructions for bypassing Xiaomi security verification with browser cookies and storing reusable account tokens in plaintext.

Install only if you understand and accept the account-security risk. Do not copy Xiaomi browser cookies, passwords, passToken, ssecurity, or serviceToken values into scripts or plaintext files on shared or synced systems. Prefer supported Xiaomi login/device authorization flows and reviewed upstream fixes instead of bypassing verification or patching authentication logic locally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: references/config-template.md:16
Finding: LLM Instruction and Role Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/miot-auth-bypass.md:83
Finding: Plaintext Storage of Xiaomi Credentials and Reusable Authentication Tokens
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/miot-auth-bypass.md:9
Finding: Security Verification Bypass Using Exported Browser Cookies and Patched Authentication Logic
Content: View full analysis
true } ); const pass = JSON.parse(data.replace('&&&START&&&', '')); // pass.securityStatus === 0 // pass.ssecurity contains the MIoT request-signing key // pass.passToken is used for the service-token exchange ``` The library is then modified to skip its normal login path when cached values exist: ```javascript // Skip login if cached credentials exist if (account.serviceToken && account.pass && account.pass.ssecurity) { console.log("Using cached " + service + " credentials, skipping login"); if (service === "miiot") { account = await MiIOT.getDevice(account); } else { account = await MiNA.getDevice(account); } return service === "miiot" ? new MiIO ...[truncated 1854 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Mutable npm Dependencies and Non-Reproducible Direct Dependency Patching
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Recommending cookie injection to bypass MIoT security verification without a strong warning is dangerous because cookies are bearer credentials and can grant account access if intercepted or reused. In this context, the skill is not merely describing a protocol; it is instructing users to defeat a live security control during deployment, which materially raises abuse risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly directs users to a browser cookie injection method to bypass Xiaomi's MIoT security verification. Even if framed as troubleshooting, this weakens an account protection mechanism and normalizes credential/session manipulation that could enable account compromise or unauthorized device control if copied, mishandled, or adapted maliciously.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The system template instructs the model to reset prior context, files, and instructions before adopting a role, which can weaken higher-priority safety or operational constraints when this prompt is reused in broader agentic environments. In a voice assistant that injects chat history and memories, this pattern increases prompt-injection susceptibility by encouraging the model to disregard prior safeguards and trust newly supplied persona/context blocks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly instructs users to use authenticated browser cookies to bypass Xiaomi's SMS/security verification, which is an authentication bypass technique rather than ordinary setup guidance. This enables reuse of an already trusted session to defeat an account protection control and obtain API credentials that would otherwise require additional verification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file teaches how to extract, replay, and persist sensitive Xiaomi session artifacts including browser cookies, passToken, ssecurity, and serviceToken. Those instructions materially enable credential theft, session hijacking, and unauthorized API access well beyond the stated purpose of configuring a voice assistant.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The text explicitly instructs the operator to reuse authenticated browser cookies from an existing Xiaomi session to bypass verification and continue account access. That is effectively a session hijacking/replay pattern that subverts intended authentication controls and can be repurposed for unauthorized account use.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow is a complete operational playbook: obtain cookies, derive tokens, inject them into config, and patch the library to skip login. This stepwise escalation lowers the barrier to abuse and turns a troubleshooting document into actionable instructions for defeating authentication and maintaining unauthorized access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill description is presented as a Chinese-only interaction context for deploying and replacing the Xiaomi assistant, with no indication that users may choose another language or locale. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README says users can simply 'request deployment of MiGPT' and the AI Agent will automatically load the skill, but it does not define exact trigger phrases, scope boundaries, or negative examples. This broad natural-language activation description could overlap with ordinary conversation about MiGPT deployment and lead to unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill tells users to place an API key in a local .env file but provides no guidance on file permissions, avoiding commits, secret rotation, or use of a secret manager. This can lead to accidental disclosure through source control, logs, backups, or shared systems, exposing the user's LLM account and any connected data or billing.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 65% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
4. Run

bash
nohup node app.js > migpt.log 2>&1 &

Critical Issues & Fixes

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
For voice assistants, latency > intelligence. Test your API endpoint:

bash
time curl -s --max-time 15 YOUR_BASE_URL/chat/completions \ -H "Authorization: Bearer YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{"model":"MODEL","messages":[{"role":"user","content":"一句话回答：今天星期几"}],"max_tokens":30}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction explicitly requires replies in Chinese ("用口语化的中文回复") and does not offer any language selection or opt-in. Under the policy criteria, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions combine account password handling with browser session cookie reuse for authentication without warning users that these values grant account access and can be abused if exposed. This normalizes unsafe secret handling practices and may lead users to paste or store sensitive credentials in insecure locations.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/miot-auth-bypass.md (reported line 68)May include surrounding context.
);

const pass = JSON.parse(data.replace('&&&START&&&', '')); // pass.securityStatus === 0 ← No verification! // pass.ssecurity ← RC4 signing key for MIoT API // pass.passToken ← Needed for service token exchange

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document directs users to write passwords, ssecurity values, passToken, and serviceToken into .mi.json, creating a durable local cache of highly sensitive secrets. Persisting these credentials without encryption, scoping, or an explicit warning increases the chance of credential leakage through backups, logs, source control, or local compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown instructs users to patch mi-service-lite so login is skipped when cached credentials are present, including serviceToken and ssecurity. While the snippet logs that cached credentials are being used, the document does not warn users that this changes authentication behavior and relies on locally stored sensitive credentials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file contains natural-language content tailored to Chinese-language usage, such as '阿里云百炼' and 'Chinese Q&A', but does not indicate whether the skill is intended only for Chinese-speaking users or provide an opt-in for locale-specific behavior. Under the policy, forcing or implicitly assuming a specific language/locale without user choice can be a violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The patch removes a guard around a response that contains a Chinese message (您已关闭流式响应...). In this file, the only explicit user-facing text shown is Chinese, and there is no indication that the skill is region-specific or that users can opt into that locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T08 · Insecure Dependencies

SkillSpector

Missing User Warnings

Context-Inappropriate Capability

Ssd 1

Description-Behavior Mismatch

Context-Inappropriate Capability

Ssd 3

Ssd 4

Natural-Language Policy Violations

Vague Triggers

Missing User Warnings

Session Persistence

4. Run

Critical Issues & Fixes

External Transmission

Natural-Language Policy Violations

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis