mijia-py-api

• Outcome: Review
• Latest audit: May 28, 2026 · 10:03 AM UTC
• Version: 1.0.0

Overview

This smart-home skill is coherent, but it can use an existing Mijia login to reveal household details and change real device state with limited built-in safeguards.

Install only if you are comfortable letting an agent use your local Mijia login to inspect household devices and perform smart-home actions. Require explicit confirmation before every state-changing command or scene run, avoid sharing setup or device-list logs, and prefer a version that masks account identifiers and enforces confirmation in code.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and relies on shell/Python execution but does not declare permissions or constraints for that capability. In an agent environment, undeclared command execution expands the attack surface and can let a loosely triggered skill inspect local files, invoke CLIs, and act on authenticated home-automation state without clear user awareness or platform enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented behavior goes beyond simple device control/status checks into local environment inspection, authentication-state checking, home/scene enumeration, and MIoT metadata discovery. That mismatch matters because users and hosting agents may grant trust based on the narrower description, while the skill can access additional sensitive information about the local system and smart-home setup.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The SOP explicitly tells the agent it may list all devices in the user's Mi Home account as part of device identification. That goes beyond the stated scope of acting on a user-requested device and can expose a broader inventory of household devices, locations, and capabilities than necessary for the task. In a smart-home context, account-wide enumeration increases privacy risk because device lists can reveal sensitive information about the home environment.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The file is described as producing a homes/rooms/devices snapshot, but it also enumerates scenes and consumable items, expanding data collection beyond the stated purpose. In a smart-home context, this over-collection can reveal behavioral patterns, automation routines, and device maintenance state that are sensitive household metadata.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The auto-trigger criteria are broad natural-language examples without clear exclusion rules or confirmation gates. In practice, this can cause the skill to activate on ambiguous conversation, leading an assistant to enumerate devices or execute physical-world actions such as switching appliances or running scenes when the user did not intend immediate control.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The notes mention extra confirmation only for a narrow set of sensitive devices, but other actions can still create privacy, safety, or property risks, such as activating appliances, opening smart-home routines, or exposing household inventory and occupancy patterns. Because this skill operates in a real smart-home context with authenticated access already present, incomplete warnings and guardrails make misuse more dangerous.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script prints home, scene, and consumable information directly to stdout without warning, consent flow, or redaction. In a home-automation skill, such output may expose household structure, automation names, and device state to logs, consoles, or downstream systems that were not intended to receive sensitive environment data.

Missing User Warnings

Low

• Confidence: 69% confidence
• Finding: The script reads a local authentication file and prints user identity information (the userId) to stdout during setup checks. In an agent or shared logging environment, this can leak account identifiers into logs or surfaces visible to other users, creating unnecessary exposure of sensitive account metadata.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.