Security audit

Shelly BluTRV Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a Shelly thermostat manager, but it includes broader device-control and credential-handling behavior than its published scope clearly authorizes.

Review before installing. Use only with a trusted, tightly protected Shelly env file; avoid the raw cloud command; confirm every write that affects heating or relays; and prefer a version that removes firmware/calibration/relay controls or gates them behind explicit user approval and strict device allowlists.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/blutrv-control.sh:21
Finding: Arbitrary shell execution through unsafe environment-file sourcing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/blutrv-control.sh:43
Finding: Unvalidated RPC destination and raw JSON interpolation permit SSRF and request manipulation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/shelly-cloud.sh:28
Finding: Shelly cloud token may be exposed through an unvalidated server URI and URL-based authentication
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/blutrv-status.sh:15
Finding: Predictable shared temporary cache permits symlink attacks, races, and telemetry disclosure
Content: View full analysis
/dev/null 2>&1; then exec 9>"$CLOUD_CACHE_LOCK" flock 9 if ! cloud_cache_fresh; then "${SCRIPT_DIR}/shelly-cloud.sh" list >"$CLOUD_CACHE_FILE.tmp" mv "$CLOUD_CACHE_FILE.tmp" "$CLOUD_CACHE_FILE" fi flock -u 9 exec 9>&- return 0 fi if ! cloud_cache_fresh; then "${SCRIPT_DIR}/shelly-cloud.sh" list >"$CLOUD_CACHE_FILE.tmp" mv "$CLOUD_CACHE_FILE.tmp" "$CLOUD_CACHE_FILE" fi ``` The same fixed cache, lock, and `.tmp` paths are independently used by `ht-status.sh`. ### Technical Analysis The files are stored in a globally shared temporary directory under constant names. Shell redirection follows symbolic links, and neither script verifies file ownership, file type, permissions, or link status before writing. An attacker able to pre-create the predictable `.tmp` or lock path can attempt a symlink or file-replacement attack. On systems without effective protected-symlink defenses, this may overwrite another file writable by the victim account. Even where operating-system protections block a symlink attack, fixed names allow denial of service, stale-data injection, and interference between users. The final cache contains the full Shelly cloud `all_status` response, potentially including device identifiers, status, network metadata, and private household telemetry. Its permissions depend on the caller's umask rather than an explicit restrictive mode. The no-`flock` branch also has no mutual exclusion. ### Attack Path 1. A local attacker predicts `/tmp/shelly-cloud-all-status.json.tmp` and `/t ...[truncated 940 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/blutrv-control.sh:11
Finding: Documented device identity verification is not enforced before thermostat writes
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/blutrv-control.sh:201
Finding: Device-altering operations exceed the published operational scope and lack explicit safety authorization
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
4. **Timeout-Handling** — `blutrv-status.sh` hat bereits integriertes Timeout + Fallback

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad everyday phrases such as "heizung," "thermostat," and "raumtemperatur" without clear scoping or exclusion conditions. This can cause the skill to activate in loosely related conversations and potentially execute heating-control actions when the user did not explicitly intend to control physical devices.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
~/.openclaw/workspace/skills/shelly-blutrv-manager/scripts/blutrv-control.sh schlafzimmer 20

Direkt via RPC (für Debugging)

curl -s -X POST "http://192.168.0.101/rpc"
-H "Content-Type: application/json"
-d '{"method":"BluTrv.Call","params":{"id":200,"method":"TRV.SetTarget","params":{"id":0,"target_C":20}}}'

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/auth-and-access.md (reported line 20)May include surrounding context.
md
- Store Shelly variables only in `~/.openclaw/skills/.shelly-blutrv-manager.env`. - Never store cloud tokens in the repository. - Never paste production tokens into chat logs or notes. - Restrict the local env file with `chmod 600`. ## Safety Rules

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 73)May include surrounding context.
Store only Shelly-related variables in that file and restrict permissions:

bash
chmod 600 ~/.openclaw/skills/.shelly-blutrv-manager.env

Validate the setup with one read operation before any write:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 175)May include surrounding context.
Store only Shelly-related variables in that file and restrict permissions:

bash
chmod 600 ~/.openclaw/skills/.shelly-blutrv-manager.env

Validate the setup with one read operation before any write:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/setup.md (reported line 50)May include surrounding context.
Store only Shelly-related variables in that file and restrict permissions:

bash
chmod 600 ~/.openclaw/skills/.shelly-blutrv-manager.env

Validate the setup with one read operation before any write:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/blutrv-control.sh (reported line 51)May include surrounding context.
sh
echo "Setting BluTRV $trv_id to ${target_temp}°C via gateway $gateway_ip..." local response response=$(curl -s -m 10 -X POST "http://${gateway_ip}/rpc" \ -H "Content-Type: application/json" \ -d "{\"id\":1,\"method\":\"BluTrv.Call\",\"params\":{\"id\":${trv_id},\"method\":\"TRV.SetTarget\",\"params\":{\"id\":0,\"target_C\":${target_temp}}}}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/blutrv-control.sh (reported line 88)May include surrounding context.
sh
# Boost = TRV.SetBoost with boost_enable=true and boost_reason=manual local response response=$(curl -s -m 10 -X POST "http://${gateway_ip}/rpc" \ -H "Content-Type: application/json" \ -d "{\"id\":1,\"method\":\"BluTrv.Call\",\"params\":{\"id\":${trv_id},\"method\":\"TRV.SetBoost\",\"params\":{\"id\":0,\"boost_enable\":true,\"boost_reason\":\"manual\"}}}")

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The override command accepts a duration parameter and tells the user the override will revert after that many seconds, but the implementation only sends a plain TRV.SetTarget request and never uses the duration value in the RPC call or schedules any later clearing action. This is an active contradiction between the inline documentation/user-facing text and the actual behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/blutrv-control.sh (reported line 185)May include surrounding context.
sh
echo "Device info for BluTRV $trv_id via gateway $gateway_ip..." curl -s -m 10 -X POST "http://${gateway_ip}/rpc" \ -H "Content-Type: application/json" \ -d "{\"id\":1,\"method\":\"BluTrv.GetRemoteDeviceInfo\",\"params\":{\"id\":${trv_id}}}" | jq '.result.device_info' }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/blutrv-control.sh (reported line 196)May include surrounding context.
sh
echo "Device info for BluTRV $trv_id via gateway $gateway_ip..." curl -s -m 10 -X POST "http://${gateway_ip}/rpc" \ -H "Content-Type: application/json" \ -d "{\"id\":1,\"method\":\"BluTrv.GetRemoteDeviceInfo\",\"params\":{\"id\":${trv_id}}}" | jq '.result.device_info' }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/blutrv-control.sh (reported line 208)May include surrounding context.
sh
echo "Device info for BluTRV $trv_id via gateway $gateway_ip..." curl -s -m 10 -X POST "http://${gateway_ip}/rpc" \ -H "Content-Type: application/json" \ -d "{\"id\":1,\"method\":\"BluTrv.GetRemoteDeviceInfo\",\"params\":{\"id\":${trv_id}}}" | jq '.result.device_info' }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/blutrv-status.sh (reported line 131)May include surrounding context.
sh
attempt=$((attempt + 1)) stderr_file=$(mktemp) if response=$( curl \ --silent \ --show-error \ --fail \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The usage text documents relay and thermostat commands that actively change device state, including toggling relays and setting target temperature, but it does not include any warning that these actions affect physical devices immediately. In the code path, these operations are executed directly via API calls without any confirmation prompt or cautionary disclosure to the user.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The raw command allows callers to reach arbitrary Shelly Cloud GET endpoints using the configured authentication token, bypassing the narrower, named operations the wrapper otherwise exposes. In an agent skill context, this expands the reachable API surface and can enable unintended reads or state-changing GET actions if the upstream API supports them, increasing the chance of misuse or prompt-driven overreach.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This shell code reads a per-user env file and exports matching variables into the process environment, which is access to potentially sensitive configuration data. There is no confirmation prompt, visible logging, or explanatory warning in the file indicating that local configuration and possible credentials will be loaded.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The function announces it is checking for firmware updates for a particular BluTRV ID, yet the request body calls BluTrv.CheckForUpdates without including the provided trv_id. That means the documentation and user-facing message describe per-device behavior that the code does not actually express.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The default target and sensor examples embed German room names such as 'schlafzimmer', 'wohnzimmer', and 'flur' as canonical aliases in code comments and defaults. This hard-codes a locale preference without offering a language choice or documenting that the skill is intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Ae1

Vague Triggers

External Transmission

Direkt via RPC (für Debugging)

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

External Transmission

External Transmission

Intent-Code Divergence

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

Intent-Code Divergence

Natural-Language Policy Violations