xiaodu-iot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:51 PM UTC
• Version: 1.0.0

Overview

This smart-home control skill matches its stated purpose, but it needs Review because it controls real devices and has under-disclosed persistence and installation risks.

Review before installing. Use this only for devices you are authorized to control, protect and rotate the Xiaodu access token, avoid running unpinned `npx -y` MCP servers with a real token, and disable or remove the MEMORY.md update unless you explicitly want household device state stored in persistent agent memory.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: scripts/update_devices.sh:106

Finding

Persistent Modification of Agent Memory

Content

View full analysis

Vulnerability Details

File Location: scripts/update_devices.sh, lines 106–120
Vulnerability Type: Persistent Agent state modification
Risk Level: High

Vulnerable Code

bash

if [ -f "$WORKSPACE/MEMORY.md" ]; then
    # 更新MEMORY.md中的设备信息
    sed -i '' '/小度设备自动更新系统/,/^## /{/小度设备自动更新系统/!{/^## /!d}}' "$WORKSPACE/MEMORY.md"
    
    # 添加新的设备信息
    echo "## 🔄 小度设备自动更新系统" >> "$WORKSPACE/MEMORY.md"
    echo "" >> "$WORKSPACE/MEMORY.md"
    echo "### 配置完成时间" >> "$WORKSPACE/MEMORY.md"
    echo "- **$(date '+%Y年%m月%d日 %H:%M')**：设备列表已更新" >> "$WORKSPACE/MEMORY.md"
    echo "" >> "$WORKSPACE/MEMORY.md"
    echo "### 设备统计" >> "$WORKSPACE/MEMORY.md"
    echo "- **小度音箱设备**：17个在线设备" >> "$WORKSPACE/MEMORY.md"
    echo "- **IoT设备**：27个设备" >> "$WORKSPACE/MEMORY.md"
    echo "- **更新日志**：$LOG_FILE" >> "$WORKSPACE/MEMORY.md"
    echo "" >> "$WORKSPACE/MEMORY.md"

Technical Analysis

The device-update script directly edits the Agent workspace's persistent MEMORY.md file. Device discovery and inventory generation do not require modification of the Agent's long-term memory.

The sed expression deletes content inside a matched section, after which the script appends Skill-controlled content. The appended device counts are hardcoded rather than calculated from the API responses. Consequently, the persistent memory may contain inaccurate state and may influence future Agent sessions after the update process has ended.

Although the inserted content is fixed in this version and does not contain explicit safety-overriding instructions, the mechanism creates an unnecessary persistent-state write primitive outside the Skill's private storage area.

Attack Path

1. A user or Agent invokes scripts/update_devices.sh.
2. The script resolves the workspace as $HOME/.openclaw/workspace.
3. If MEMORY.md exists, the script uses sed to delete content from the matching memory section.
4. It appends ...[truncated 756 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all direct reads and writes to $WORKSPACE/MEMORY.md.
2. Store generated state in a Skill-specific directory, such as $HOME/.openclaw/workspace/xiaodu-control/.
3. If memory integration is required, make it explicitly opt-in and display the exact proposed update before writing it.
4. Restrict updates to a uniquely delimited section owned by the Skill and avoid deletion patterns that may affect adjacent content.
5. Calculate device counts from validated API responses rather than inserting hardcoded values.
6. Write updates atomically through a securely created temporary file and preserve a backup of the previous state.
7. Apply restrictive permissions to any state file containing device inventory or local path information.

T08 · Insecure Dependencies

Error

• Location: config_template.json:13

Finding

Unpinned Third-Party Package Is Automatically Downloaded and Executed with an Access Token

Content

View full analysis

Vulnerability Details

File Location: config_template.json, lines 13–18; duplicated in references/iot_api.md, lines 14–22, and scripts/init_skill.py, lines 172–177
Vulnerability Type: Unpinned runtime dependency and automatic package execution
Risk Level: High

Vulnerable Code

json

"xiaodu-iot": {
  "command": "npx",
  "args": ["-y", "dueros-iot-mcp"],
  "env": {
    "ACCESS_TOKEN": "YOUR_ACCESS_TOKEN_HERE"
  }
}

Equivalent configuration generated by scripts/init_skill.py:

python

"xiaodu-iot": {
    "command": "npx",
    "args": ["-y", "dueros-iot-mcp"],
    "env": {
        "ACCESS_TOKEN": "your_access_token_here"
    }
}

Technical Analysis

The MCP configuration invokes npx -y dueros-iot-mcp without an exact package version, lockfile, integrity value, or local installation requirement. The -y option suppresses the interactive installation confirmation.

When the package is absent from the local cache, npx may resolve and download the current registry version at runtime. This makes the effective executable code mutable after the Skill has been reviewed. A compromised package release, registry account, dependency, or package-resolution process could therefore introduce arbitrary local code.

The process also receives ACCESS_TOKEN in its environment. Code executed by the package can read that token and use the invoking user's filesystem and network permissions.

Attack Path

1. The user copies or generates the documented MCP configuration.
2. The user replaces the token placeholder with a valid Xiaodu access token.
3. The MCP client starts the xiaodu-iot server.
4. npx -y resolves dueros-iot-mcp from the configured npm registry without requiring confirmation.
5. A compromised or malicious package version executes locally.
6. The package reads ACCESS_TOKEN from its environment.
7. The package may transmit the token, access user ...[truncated 679 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dueros-iot-mcp to a reviewed exact version rather than resolving the latest version.
2. Install dependencies through a committed lockfile containing integrity metadata.
3. Do not download packages automatically during normal Skill or MCP invocation.
4. Verify the package publisher, provenance, signatures, and transitive dependency tree.
5. Use an organization-controlled registry or verified package mirror where appropriate.
6. Run the MCP server in a sandbox with restricted filesystem and network access.
7. Supply a narrowly scoped, revocable token rather than a broadly privileged credential.
8. Ensure the token is not inherited by unrelated child processes.
9. Update config_template.json, references/iot_api.md, and scripts/init_skill.py consistently so generated and documented configurations use the hardened dependency mechanism.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/update_devices.sh:22

Finding

Predictable Files in Shared Temporary Directory Permit Symlink Overwrite and Race Conditions

Content

View full analysis

Vulnerability Details

File Location: scripts/update_devices.sh, lines 22–30, 66–74, and 129–130
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

bash

if mcporter call xiaodu.list_user_devices > /tmp/xiaodu_devices.json 2>> "$LOG_FILE"; then
    echo "✅ 小度音箱设备列表获取成功" | tee -a "$LOG_FILE"
    
    # 解析并格式化设备信息
    echo "# 小度智能设备清单" > "$DEVICE_FILE"
    echo "" >> "$DEVICE_FILE"
    echo "## 📊 设备概览" >> "$DEVICE_FILE"
    echo "- **更新时间**: $(date '+%Y年%m月%d日 %H:%M:%S')" >> "$DEVICE_FILE"
    echo "- **设备总数**: $(jq '.devices | length' /tmp/xiaodu_devices.json)个在线设备" >> "$DEVICE_FILE"

bash

if mcporter call xiaodu-iot.GET_ALL_DEVICES_WITH_STATUS > /tmp/iot_devices.json 2>> "$LOG_FILE"; then
    echo "✅ IoT设备列表获取成功" | tee -a "$LOG_FILE"
    
    # 解析并格式化IoT设备信息
    echo "# 小度IoT设备清单" > "$IOT_DEVICE_FILE"
    echo "" >> "$IOT_DEVICE_FILE"
    echo "## 📊 IoT设备概览" >> "$IOT_DEVICE_FILE"
    echo "- **更新时间**: $(date '+%Y年%m月%d日 %H:%M:%S')" >> "$IOT_DEVICE_FILE"
    echo "- **设备总数**: $(jq '.devices | length' /tmp/iot_devices.json)个设备" >> "$IOT_DEVICE_FILE"

bash

# 清理临时文件
rm -f /tmp/xiaodu_devices.json /tmp/iot_devices.json

Technical Analysis

The script uses fixed, predictable filenames in the globally shared /tmp directory. It does not create the files exclusively, verify file ownership, reject symbolic links, or allocate a private temporary directory.

Shell output redirection follows symbolic links. A local attacker who can write to /tmp may create one of the expected paths as a symbolic link to another file writable by the victim. When the script performs redirection, the linked target can be truncated and overwritten with device API output.

Concurrent invocations can also read, overwrite, or delete each other's temporary files. Because the files contain device inventory and status data, insecure permissions may ...[truncated 1352 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a private temporary directory with mktemp -d.
2. Set umask 077 before creating files containing device information.
3. Store both JSON files inside the private directory.
4. Register a cleanup trap immediately after successful directory creation.
5. Quote every temporary path and never reuse globally predictable names.
6. Validate that temporary files are regular files owned by the current user before reading them.
7. Avoid following symbolic links and use exclusive file creation where supported.
8. Keep temporary files open only for the minimum required duration.

Example hardened pattern:

bash

umask 077
TMP_DIR="$(mktemp -d)" || exit 1
trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM

XIAODU_JSON="$TMP_DIR/xiaodu_devices.json"
IOT_JSON="$TMP_DIR/iot_devices.json"

mcporter call xiaodu.list_user_devices > "$XIAODU_JSON"
mcporter call xiaodu-iot.GET_ALL_DEVICES_WITH_STATUS > "$IOT_JSON"

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING.md (reported line 14)May include surrounding context.

md

## 发布准备检查清单

### ✅ 已完成的安全检查
1. **敏感信息清理**：所有真实Access Token、CUID、Client ID已替换为占位符
2. **个人信息移除**：设备名称通用化，无个人标识
3. **配置占位符**：使用`YOUR_*`格式的配置变量
4. **示例代码安全**：所有示例使用通用设备信息

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING.md (reported line 22)May include surrounding context.

md

## 发布准备检查清单

### ✅ 已完成的安全检查
1. **敏感信息清理**：所有真实Access Token、CUID、Client ID已替换为占位符
2. **个人信息移除**：设备名称通用化，无个人标识
3. **配置占位符**：使用`YOUR_*`格式的配置变量
4. **示例代码安全**：所有示例使用通用设备信息

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING.md (reported line 86)May include surrounding context.

md

## 发布准备检查清单

### ✅ 已完成的安全检查
1. **敏感信息清理**：所有真实Access Token、CUID、Client ID已替换为占位符
2. **个人信息移除**：设备名称通用化，无个人标识
3. **配置占位符**：使用`YOUR_*`格式的配置变量
4. **示例代码安全**：所有示例使用通用设备信息

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

## 发布准备检查清单

### ✅ 已完成的安全检查
1. **敏感信息清理**：所有真实Access Token、CUID、Client ID已替换为占位符
2. **个人信息移除**：设备名称通用化，无个人标识
3. **配置占位符**：使用`YOUR_*`格式的配置变量
4. **示例代码安全**：所有示例使用通用设备信息

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_skill.py (reported line 99)May include surrounding context.

python

## 发布准备检查清单

### ✅ 已完成的安全检查
1. **敏感信息清理**：所有真实Access Token、CUID、Client ID已替换为占位符
2. **个人信息移除**：设备名称通用化，无个人标识
3. **配置占位符**：使用`YOUR_*`格式的配置变量
4. **示例代码安全**：所有示例使用通用设备信息

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims it can control devices and send voice instructions, but the findings indicate the implementation mainly synchronizes device inventories and updates local documentation and memory files. Undisclosed persistence such as workspace logs or MEMORY.md changes can expose sensitive household metadata and creates a broader attack surface than the user-facing description suggests.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims it can control devices and send voice instructions, but the findings indicate the implementation mainly synchronizes device inventories and updates local documentation and memory files. Undisclosed persistence such as workspace logs or MEMORY.md changes can expose sensitive household metadata and creates a broader attack surface than the user-facing description suggests.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/iot_api.md (reported line 248)May include surrounding context.

ACCESS_TOKEN: <your_access_token>

text

### 3. Access Token获取
Access Token通过百度DuerOS开放平台获取，有效期30天。需要定期刷新。

### 4. 配置命令

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/xiaodu_mcp.md (reported line 20)May include surrounding context.

ACCESS_TOKEN: <your_access_token>

text

### 3. Access Token获取
Access Token通过百度DuerOS开放平台获取，有效期30天。需要定期刷新。

### 4. 配置命令

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/xiaodu_mcp.md (reported line 21)May include surrounding context.

ACCESS_TOKEN: <your_access_token>

text

### 3. Access Token获取
Access Token通过百度DuerOS开放平台获取，有效期30天。需要定期刷新。

### 4. 配置命令

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/xiaodu_mcp.md (reported line 140)May include surrounding context.

ACCESS_TOKEN: <your_access_token>

text

### 3. Access Token获取
Access Token通过百度DuerOS开放平台获取，有效期30天。需要定期刷新。

### 4. 配置命令

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/xiaodu_mcp.md (reported line 141)May include surrounding context.

ACCESS_TOKEN: <your_access_token>

text

### 3. Access Token获取
Access Token通过百度DuerOS开放平台获取，有效期30天。需要定期刷新。

### 4. 配置命令

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/xiaodu_mcp.md (reported line 148)May include surrounding context.

ACCESS_TOKEN: <your_access_token>

text

### 3. Access Token获取
Access Token通过百度DuerOS开放平台获取，有效期30天。需要定期刷新。

### 4. 配置命令

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/xiaodu_mcp.md (reported line 184)May include surrounding context.

ACCESS_TOKEN: <your_access_token>

text

### 3. Access Token获取
Access Token通过百度DuerOS开放平台获取，有效期30天。需要定期刷新。

### 4. 配置命令

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/update_devices.sh (reported line 131)May include surrounding context.

sh

echo "IoT设备文件: $IOT_DEVICE_FILE" | tee -a "$LOG_FILE"

# 清理临时文件
rm -f /tmp/xiaodu_devices.json /tmp/iot_devices.json

echo "✅ 所有设备更新完成！"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The publishing documentation describes device discovery, remote device control, and voice broadcasting capabilities without warning users about privacy exposure and real-world operational effects. In an IoT control skill, lack of explicit notice can lead users to enable features that enumerate household devices or trigger physical actions without understanding the implications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documents file-writing behavior such as updating device lists and logs, but it does not declare any tool scope or allowed-tools restrictions. This weakens least-privilege controls and can allow unintended local file modification if the skill is executed in an environment that grants broader filesystem access than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation encourages commands that can immediately actuate physical devices, trigger scenes, or broadcast audio, but it does not warn about the real-world effects. In a smart-home context this is more dangerous because mistaken, coerced, or automated execution can alter the home environment, affect safety, or disturb occupants.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requires an access token for device control but gives no warning about protecting it from exposure in shell history, logs, shared files, or screenshots. In a home-automation skill, token compromise can permit unauthorized device control, device enumeration, and misuse of voice-broadcast capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation exposes a remote photo-capture capability for camera-equipped devices without any warning about consent, privacy expectations, or access restrictions. In a smart-home control skill, this is sensitive because it enables surveillance-like behavior and could facilitate covert image capture if a token or account is misused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file presents its purpose and user-facing text exclusively in Chinese, including the generated SKILL.md content and CLI messages. That imposes a specific language on users without offering an alternative or documenting a locale-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This shell script sends the supplied text plus device CUID and client ID via mcporter call, which is a network- or IPC-style transmission of user and device data. Although it prints what it is doing, there is no user-facing warning about privacy or data transmission implications; the existing output is operational rather than a disclosure of potential impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script retrieves and stores household device inventory in workspace files and logs without any explicit user-facing notice or consent flow. Device names, counts, and topology can reveal sensitive information about a user's home environment, and persisting them increases exposure if the workspace is shared, synced, or later accessed by other tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script claims to parse fetched device information but instead writes hard-coded device statistics. This is dangerous because it can mislead the user or downstream automation into trusting fabricated inventory data, causing incorrect operational decisions or masking the true device state.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The IoT section similarly claims to format retrieved data but persists a hard-coded list of devices and categories instead of the actual API response. In a smart-home control context, inaccurate persisted inventory can conceal real devices, invent nonexistent ones, or misdirect follow-on actions that depend on this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.