Yeelight WiFi LAN Control

• Outcome: Review
• Latest audit: Oct 12, 2026 · 5:40 AM UTC
• Version: 0.1.0

Overview

This is a coherent local Yeelight LAN-control skill: it can affect lights and local home records, but those capabilities are disclosed, scoped to the LAN, and bounded by confirmation or execution gates.

Install this only if you want an agent to discover and control Yeelight WiFi lights on your local network. It can change physical light state, create local scenes/schedules, briefly open a local listener for confirmed music mode, and keep local home metadata on disk; it does not appear to use cloud accounts or credentials. Expect some Chinese default names and error text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

Multi-device scene application is not transactional. The runtime persists a
pre-state/recovery record before writing, verifies every device, and reports exact
success, skipped, failed, or uncertain rows. Offer `operation.recover` only after
explicit confirmation. Recovery re-reads first and refuses to overwrite state that
has drifted outside the known transition.

## Scheduling

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

printf '%s' '{"operation":"discover"}' | sh scripts/invoke.sh

text

PowerShell uses `scripts/invoke.ps1` with the same stdin/stdout contract. Never ask
the user to paste protocol commands, IP addresses, raw JSON, credentials, or
network packets. Never call `yeelight-home`, cloud APIs, MCP, OAuth, or a Pro home.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is broadly described as handling discovery, control, organization, and troubleshooting of local WiFi lights, while allow_implicit_invocation: true permits activation without a tightly scoped user request. This can cause the agent to invoke the skill for vague home-organization or automation requests, leading to unintended device discovery or control actions on the local network.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/workflow.md (reported line 23)May include surrounding context.

md

Use saved friendly references first. Resolve aliases, rooms, groups, and scenes to
stable device IDs inside the runtime. Refresh stale saved targets before a write. A
new endpoint requires the opaque rebind challenge; do not ask the user to compare raw
IP addresses. If the same ID appears from different senders in one discovery window,
report an identity collision and do not import it.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Multiple thrown MusicError messages are written only in Chinese, and the file provides no locale selection, fallback, or opt-in mechanism. This imposes a specific language on users and matches the policy concern about forced language/locale without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Validation errors for sequence handling are presented exclusively in Chinese, with no indication that users can choose another language. This is a natural-language policy issue because the skill forces one locale for user-visible failures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Runtime validation failures such as missing device, missing transport, and invalid duration use Chinese-only strings. Without any opt-in or locale negotiation, these messages force a specific language on all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Errors for listener startup failure are emitted only in Chinese, and no locale abstraction is present in the module. This constitutes a forced-language policy issue for user-visible diagnostics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The timeout, peer mismatch, and stopped-session errors are user-visible strings written only in Chinese. The module does not provide any way to choose language or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The constant RECOVERY_CONFIRMATION is hard-coded to the Chinese phrase 确认恢复场景操作, and recoverOperation later requires the provided confirmation to exactly match this value. This creates a language-specific interaction requirement that does not offer a locale choice or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code returns natural-language messages in Chinese, such as the invalid timestamp error at L0124, and the pattern continues throughout the file for confirmations and failures. Because the file does not offer any locale selection or fallback, it appears to enforce a specific language, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code defines user-facing scene names, descriptions, and many error messages entirely in Chinese, with no visible mechanism to let the user choose a language or opt into a locale-specific experience. The applicable policy flags forced language/locale behavior unless it is explicitly documented and justified as region-specific or user-selectable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file uses the literal locale "en-US" when validating and formatting date/time data, including in Intl.DateTimeFormat calls. The policy explicitly disallows forcing a specific language or locale unless the skill offers user choice or clearly documents and justifies the constraint, which is not present in this code file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The formatLocalDateTime function constructs Intl.DateTimeFormat("en-US", ...), which enforces a specific locale for formatting behavior. Because the file contains no opt-in mechanism or documented locale restriction, this matches the natural-language locale-policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The formatLocalWeekday function uses Intl.DateTimeFormat("en-US", ...) and then depends on English weekday abbreviations. This creates an implicit English/US locale dependency without any visible user opt-in or policy justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The resetStore function performs an irreversible overwrite of the local store contents by creating a fresh store and writing it to disk. Although it requires a confirmation token programmatically, there is no user-facing prompt, log, comment warning users about data loss, or visible disclosure in this file about the destructive effect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This JSON file contains natural-language scene names exclusively in Chinese across the listed entries. Because the file does not indicate that the skill is region-specific or that users can opt into this locale, it may violate the language/locale policy requiring choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The thrown confirmation error message is written only in Chinese: "重新绑定设备端点需要明确确认。". This imposes a specific language on users without opt-in, fallback, or any documented region-specific justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This function opens a TCP server, waits for an incoming device connection, and sends a set_music control request to the device, but there is no confirmation prompt, logging, or user-facing disclosure around these network operations. Because this affects local network behavior and remote device state, the code lacks visible warning/disclosure within the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code hardcodes the default home name to "我的家", which imposes a Chinese-language default on all users. The policy allows locale-specific behavior only when users are given a choice or the constraint is clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

When resetting the store, the fallback home name is again set to "我的家" if no prior name exists. This repeats the same forced-language behavior during a recovery/destructive flow without offering a locale choice or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The mock data uses fixed Chinese names such as device labels and later operations continue this pattern, which reflects a specific language choice embedded in the skill behavior. Because the file provides no natural-language indication of user opt-in or locale selection, this can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/response.mjs:5