Yeelight Smart Home

• Outcome: Pass
• Latest audit: Jul 21, 2026 · 12:04 AM UTC
• Version: 0.1.14

Overview

This is a disclosed Yeelight smart-home control skill with powerful but purpose-aligned actions routed through a local runtime and guarded by validation and confirmations.

Install this only if you intend to let a local Yeelight runtime control and configure your smart home. Review destructive confirmations carefully, keep authentication inside the yeelight-home CLI rather than chat, and be aware that explicit Yeelight preferences and operation lessons may be stored locally by the runtime.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill metadata says it must use only `yeelight-home invoke --stdin`, but the workflow additionally authorizes `node scripts/product-select.mjs`. That expands the execution surface beyond the declared trusted runtime, creating a path for unreviewed code execution, argument handling bugs, or data access outside the intended boundary.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The domain catalog includes third-party ecosystem integration surfaces and credential-adjacent fields such as bind keys, device IDs, domains, and sync state for Miot, Midea, and Haier. In a skill whose role is Yeelight home control/catalog access, bundling these writable integration capabilities expands the attack surface and could enable unauthorized cross-ecosystem linking, reconfiguration, or leakage of sensitive integration metadata if the runtime exposes them.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The packaged schema exposes sensitive network and authentication-oriented properties including IP address, SSID, Wi-Fi password, MAC address, local token, and external IP as modelled capabilities. Even if this file is only metadata, presenting these fields as accessible runtime properties creates a clear path for secret exposure or unsafe device/network reconfiguration by an agent using the catalog.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The reference explicitly instructs the agent to run `node scripts/product-select.mjs ...`, which violates the skill boundary that requires using only `yeelight-home invoke --stdin`. This introduces an unauthorized execution path outside the declared runtime, increasing the risk of arbitrary local code execution, policy bypass, and access to host resources not mediated by the approved CLI.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill metadata explicitly says the runtime must use only `yeelight-home invoke --stdin`, but this reference instructs the agent to execute `node scripts/product-select.mjs`. That creates an unauthorized execution path outside the declared interface, increasing the risk of local code execution, hidden side effects, and bypass of the runtime’s intended control boundary.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This documentation defines core behavior through an external script path that is not part of the manifest-described workflow. In an agent skill, undocumented or out-of-band tooling is dangerous because it can cause the agent to invoke local scripts with user-derived arguments, undermining sandboxing, auditability, and operator expectations about what the skill is allowed to execute.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: This entry uses extremely broad aliases such as generic color/style/product words that are likely to collide with ordinary user utterances rather than uniquely identify a specific SKU. In a smart-home control skill, ambiguous activation can cause the system to resolve to the wrong device or product entry, leading to unintended control actions or bad recommendations.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The aliases at this location are also overly generic and can match common descriptive speech instead of a specific product identity. Because this catalog feeds a smart-home skill, such collisions can misroute intents to the wrong catalog item and increase the chance of unintended automation, control, or misleading product selection.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation guidance is broad enough to apply this reference whenever a result is returned or for many generic user intents, which increases the chance the skill steers responses outside the narrow Yeelight task context. In an agent setting, over-broad presentation rules can override safer, more context-appropriate behavior and cause unintended disclosure, misleading summaries, or misuse of formatting instructions across unrelated requests.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The reference mandates Chinese-language field labels such as `状态`, `对象`, `位置`, `结果`, `验证`, and `下一步` without checking the user's language preference. This can cause the agent to ignore user locale, degrade comprehension, and produce misleading or unusable operational output during device control, diagnostics, or safety-relevant follow-up.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The examples and trigger phrases repeatedly encode Chinese-only output patterns and Chinese query heuristics without documenting locale scope, which can bias response generation toward a single language even for non-Chinese users. In a smart-home control skill, that raises the risk of user misunderstanding, incorrect confirmation of actions, and poor handling of diagnostics or warnings.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.