Lg Thinq Universal

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.1.0

Overview

This LG ThinQ skill is mostly coherent for discovering and controlling appliances, but it needs review because it mandates global memory persistence and enables physical device control with broad account-token access.

Install only if you trust this publisher and are comfortable giving an LG ThinQ PAT to a local tool that can list and control your appliances. Use a least-privilege token, keep it in shell environment or the universal skill root only, review every setup manifest before approving, inspect generated device commands, and decline or remove any global MEMORY.md entry unless you explicitly want those device details persisted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd, cwd=None, capture=False, env=None, exit_on_error=True):
    """Run a shell command safely."""
    try:
        result = subprocess.run(
            cmd, 
            cwd=cwd, 
            shell=True,

• Confidence: 96% confidence
• Finding: The helper wraps subprocess.run with shell=True and accepts string commands, which creates a command-injection surface if any part of the command string is influenced by environment variables, file paths, or device/profile metadata. In this file, several commands interpolate paths and later execute generated code and package installation commands, making the risk real rather than theoretical.

Tainted flow: 'target_control_path' from os.getenv (line 238, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

# Write the generated code
    target_control_path = os.path.join(skill_path, "lg_control.py")
    with open(target_control_path, "w") as f:
        f.write(lg_control_code)
    
    # Make executable

• Confidence: 91% confidence
• Finding: The script writes executable generated code to a path under skill_path, and skill_path ultimately depends on an environment-controlled root. If an attacker can influence OPENCLAW_SKILLS_ROOT or the directory structure, this can become an arbitrary file-write primitive and may overwrite sensitive files or place executable code in attacker-chosen locations.

Tainted flow: 'skill_path' from os.getenv (line 185, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

shutil.copy(CACHE_FILE, os.path.join(skill_path, ".api_server_cache"))

    # Create Local .env
    with open(os.path.join(skill_path, ".env"), "w") as f:
        f.write(f"LG_DEVICE_ID={args.id}\n")
    log("Created local .env (Credential Isolation).")

• Confidence: 90% confidence
• Finding: This writes a .env file containing a device identifier into a destination influenced by environment configuration. If the workspace root can be redirected, the script can write configuration files into unintended locations, potentially overwriting existing files or disclosing device-specific identifiers in shared directories.

Tainted flow: 'skill_path' from os.getenv (line 185, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

skill_path=skill_path,
        properties=profile_data.get("response", {}).get("property", {}),
    )
    with open(os.path.join(skill_path, "SKILL.md"), "w") as f:
        f.write(skill_md)
    log("Generated SKILL.md.")

• Confidence: 89% confidence
• Finding: The script writes SKILL.md to a path under a configurable root without validating that the resolved destination is safe. In combination with --force and symlink/path manipulation, this can contribute to arbitrary file overwrite in user-accessible or sensitive locations.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document declares a mandatory requirement to obtain user consent before every file creation or modification, but the later setup steps instruct creating and moving files, generating scripts, and writing .env files without repeating a consent gate. In an agent-executed workflow, this inconsistency can lead to unauthorized local filesystem changes despite the stated security protocol.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code explicitly labels the helper as safe while implementing it with shell=True and string commands, which is a misleading safety claim and a real injection hazard. This increases operational risk because later maintainers may trust the wrapper and pass untrusted input into it.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The generated script claims the local .env file is only for LG_DEVICE_ID, but load_dotenv(env_path, override=False) imports all variables present in that file. This can cause operators to place sensitive values such as LG_PAT in a local project file under false assumptions, increasing the risk of accidental credential exposure through source control, artifact leakage, or local file disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to persist a trigger phrase, skill path, and command summary into a global MEMORY.md, creating cross-project state that may expose device identifiers, usage patterns, filesystem locations, or other operational details to unrelated future tasks. In an agent environment, global memory is a shared persistence boundary, so storing integration details there increases the risk of unintended disclosure and context bleed.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The document provides direct device-control endpoints and example commands that can alter physical appliance state without an explicit safety warning or confirmation requirement. In an agent skill context, this can normalize or enable unsafe automation behavior, leading to unintended actuation of real-world devices such as powering appliances on/off or changing operating modes.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The natural-language mapping example `it's too hot` triggers a compound action (`on` + `cooltargettemperature 22`) that is broad, subjective, and capable of changing physical device state without an explicit command. In an agent setting, ambiguous triggers increase the risk of unintended actuation, especially because the skill controls a real appliance.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The guide encourages broad, ambiguous natural-language mappings such as 'too hot,' 'comfortable,' and 'home,' which can cause the skill to trigger on casual conversation rather than clear device-control intent. In an agentic environment, this raises the risk of unintended actuation of physical devices, especially when paired with automatic command sequencing like powering on and changing settings.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide explicitly requires saving the skill's name, path, and commands to the user's MEMORY.md file as a mandatory final step, but does not require user notice, consent, or any limitation on what may be persisted. This creates an unauthorized persistence channel that can store operational details or sensitive context and normalize silent modification of user-owned state.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Persisting user/device interaction details into a global memory file can leak information across sessions, users, or projects, especially in shared agent environments. Even though the skill says not to copy the PAT, the saved trigger phrase, skill path, and command summary can still reveal sensitive home automation metadata and enable later unauthorized inference about the user's devices or setup.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The handoff instructs persisting device-specific usage details and trigger phrases to a global MEMORY.md file, creating unnecessary long-term retention of potentially sensitive information. In an agent ecosystem, global memory may later be exposed to unrelated tasks or users, causing cross-context leakage.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1.  **Engine Generation**: Builds a bug-free `lg_control.py` specialized for that hardware.
2.  **Credential Isolation**: Automatically creates a local `.env` with ONLY the `LG_DEVICE_ID`.
3.  **Environment Setup**: Creates a `venv` and installs all dependencies.
4.  **Verification**: Automatically runs a `status` check to prove the connection works.

---

• Confidence: 82% confidence
• Finding: This section authorizes an assembly script to automatically create environments, install dependencies, and run a live status check, which can trigger network and filesystem actions with limited human review. In a security-sensitive agent context, delegating multiple side effects to a script increases the chance of unintended execution, dependency risk, or unreviewed contact with external systems and devices.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0
requests>=2.25.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound range instead of an exact version, which makes builds non-reproducible and can unexpectedly pull in vulnerable or incompatible releases over time. While not directly exploitable on its own, this weakens supply-chain control and increases the chance that a vulnerable package version will be installed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0
requests>=2.25.0

• Confidence: 95% confidence
• Finding: The requests package is unpinned, so installations may resolve to different versions across environments or over time. This creates supply-chain risk and can silently introduce vulnerable releases or behavioral changes that affect security-sensitive network code.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: The file allows installation of python-dotenv versions that may include a known advisory, and the listed issue involves symlink following in set_key that can enable arbitrary file overwrite in affected use cases. The danger depends on whether the skill actually invokes the vulnerable API on attacker-controlled paths, but the requirement currently does not exclude affected versions.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirements entry permits affected requests versions despite multiple published advisories, including credential leakage and TLS/session verification issues. Because requests is a core HTTP client often used with untrusted URLs and remote services, leaving the version unconstrained to safe releases can expose secrets or weaken transport security in realistic deployments.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-reference.md:99