Security audit

Sony Tv

Security checks for vulnerabilities and agentic risk

Overview

This Sony TV control skill is mostly purpose-aligned, but it publishes a TV control key and includes an unauthenticated LAN control/diagnostic server that users should review before use.

Install only if you control the target TV and local network. Before use, replace the hardcoded IP and PSK with private configuration, rotate the exposed PSK, and avoid running the optional server on a shared LAN unless you add authentication or bind it to localhost. Treat URL-opening, app-kill, and power commands as actions that should require explicit user intent.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill contains shell commands, network access, and use of environment-like configuration values, but declares no permissions. That creates a transparency and policy-enforcement gap: users and platforms cannot accurately assess or constrain what the skill can do before use. In this case the hidden capabilities include direct device control and network communication to a local TV and optional local services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The documented behavior understates what the skill can do. Beyond simple TV control, the skill describes status retrieval, diagnostic collection, browser launching to arbitrary URLs, and broader app-control behaviors; this expands the attack surface and can mislead users into authorizing more access than they intend. Behavior/description mismatch is especially risky in agent skills because trust decisions are made from the description.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The optional test server adds functionality beyond direct TV control by hosting pages, collecting results, and exposing a web UI. That broadens the trust boundary from a single local device command channel to a local web service that can receive data and potentially be accessed by other devices on the network. Even if labeled optional, documenting and bundling it with the skill increases the likelihood it will be deployed without proper hardening.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The diagnostic workflow goes beyond controlling the TV and inventories browser/device capabilities, including Sony proprietary APIs and USB-reading related functionality. Capability probing can reveal sensitive environmental details and encourage use of interfaces unrelated to the user-facing purpose of the skill. This is a scope-expansion issue that meaningfully increases privacy and misuse risk.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The diagnostic page automatically collects browser and device details, then silently posts them to /api/diag-results without any user consent or clear disclosure. Even though the data is not highly sensitive by itself, it enables device fingerprinting and unexpected telemetry collection from a TV/browser context, which is especially problematic because the page presents itself as a local capability test.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The UI states that the page runs in the Sony TV browser to test capabilities, but the implementation also silently sends the collected results to the server. This mismatch is dangerous because it undermines informed consent and can mislead users into exposing device metadata they reasonably believe remains local.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The /api/localIP endpoint discloses internal network addressing to any party that can reach the server, which is not necessary for core TV control. In a home/LAN control service, exposing local IP information can aid reconnaissance and make follow-on targeting of adjacent devices easier.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The diagnostics receiver accepts arbitrary JSON, stores it globally, and exposes it back via GET without authentication or schema validation. That turns the service into a local data sink/exfiltration point and could allow untrusted content injection into logs or downstream consumers, exceeding the stated TV-control purpose.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that diagnostic results are automatically POSTed back to a server, but does not present an explicit warning, consent mechanism, or data inventory. Silent transmission of device/browser diagnostics creates privacy risk and can expose internal network, browser, or platform details to another service. Automatic collection is more concerning because the TV browser is being directed to a supplied URL and then sends results back without an explicit acknowledgement step.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The page automatically posts diagnostic results, user agent, page URL, and timestamp to the server with no warning, consent, or visible indicator. In a local-network device control skill, this creates covert telemetry behavior that can leak environment details and normalize silent data collection from embedded-device browsers.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: On failure, the page silently sends error text, user agent, and timestamp to the server. Error messages can reveal implementation details, runtime behavior, or unexpected state, and posting them automatically without disclosure compounds the privacy and transparency issue.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The script hardcodes a pre-shared key directly in the file and uses it for authenticated control of the TV without any warning, secret-handling guidance, or access controls. Anyone who can read the skill source, logs, backups, or repository can recover the PSK and remotely control the device on the local network, making this a real credential exposure issue.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The open-url command forwards user-supplied input directly into a JSON request that instructs the TV browser runtime to open an arbitrary URL, with no validation, allowlist, or warning. In this skill context, that can be abused to push the TV to attacker-controlled content, tracking endpoints, phishing pages, or unexpected local-network URLs, especially if an upstream agent can invoke the command on behalf of a user.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: docs/diag-results.json:62