Security audit

Xiaomi

Security checks for vulnerabilities and agentic risk

Overview

The skill is for legitimate Xiaomi device control, but it under-discloses sensitive token handling and direct physical-device actuation risks.

Review before installing. Only use this with devices you control, keep Xiaomi tokens out of shared repositories and agent-visible documents, prefer a protected local secret store, and require explicit confirmation before commands that turn appliances on or alter operating modes. Treat any copied token as a credential that may need rotation if exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Third-Party Dependencies Enable Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4` **Vulnerability Type**: Unpinned package installation from an external package registry **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🏠","requires":{"bins":["miiocli"]},"install":[{"id":"pipx-miio","kind":"exec","command":"pipx install python-miio && /Users/$(whoami)/.local/pipx/venvs/python-miio/bin/python -m pip install 'click<8.1.0'","label":"Install python-miio via pipx (with click fix)"}]}} ``` ### Technical Analysis The installation command retrieves `python-miio` and its transitive dependencies from the configured Python package registry without pinning an exact version, validating cryptographic hashes, or using a reviewed lockfile. It then modifies the installed environment with the broad constraint `click<8.1.0`. Because dependency resolution is mutable, the code installed during one review may differ from the code installed later. Python packages and their build systems may execute code during installation. Consequently, compromise of the package, one of its transitive dependencies, the package registry, or the local registry configuration could result in arbitrary code execution. The path `/Users/$(whoami)/...` is also platform-specific and relies on shell expansion, but no attacker-controlled value is shown entering that expression in the audited artifact. ### Attack Path 1. An attacker compromises a resolved package release, a transitive dependency, the configured registry, or the dependency distribution channel. 2. The user installs the Skill and its installation command invokes `pipx` and `pip`. 3. The package manager resolves the mutable, unpinned dependency versions. 4. Malicious package installation or build logic executes with the privileges of the user performing the installation. 5. The malicious dependency can access data and resources available to that user and alter the created Python environment. This path is conditional on a ...[truncated 586 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `python-miio`, `click`, and all transitive dependencies to reviewed, exact versions. 2. Use a lockfile or requirements file containing cryptographic hashes, and enforce hash verification during installation. 3. Install only from an explicitly configured and trusted package index. 4. Review dependency source code and release provenance before updating pinned versions. 5. Replace the post-install dependency mutation with a reproducible, tested dependency specification. 6. Avoid hard-coded, user-specific interpreter paths; use the environment created by `pipx` through supported commands. 7. Run installation with ordinary user privileges in an isolated environment and never require administrator access unless strictly necessary. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:25
Finding: Device-Control Tokens Are Stored in Plaintext and Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-40` **Additional Location**: `SKILL.md:55-59` **Vulnerability Type**: Insecure storage and handling of sensitive device credentials **Risk Level**: High ### Vulnerable Code ```markdown 1. **Tokens**: Obtain device IPs and Tokens using the bundled script: ```bash python3 scripts/token_extractor.py ``` 2. **Registry**: Store your device details in `references/devices.md` or `references/my_private_devices.md`. ## 🤖 Natural Language Intents When the user gives a command, map it to the corresponding `miiocli` operation: | User Intent | Device Type | Action | Technical Command (Example) | | :--- | :--- | :--- | :--- | | "Turn on water heater" | Smart Plug | Power ON | `miiocli miotdevice --ip <IP> --token <TOKEN> raw_command set_properties '[{"siid": 2, "piid": 1, "value": true}]'` | | "Turn off water heater" | Smart Plug | Power OFF | `miiocli miotdevice --ip <IP> --token <TOKEN> raw_command set_properties '[{"siid": 2, "piid": 1, "value": false}]'` | | "Humidifier to max" | Humidifier | Set Mode | `miiocli miotdevice --ip <IP> --token <TOKEN> set_property_by 2 5 3` | | "Is rice cooked?" | Rice Cooker | Check Status | `miiocli cooker --ip <IP> --token <TOKEN> status` | ``` ### Technical Analysis Xiaomi device tokens are authentication secrets that authorize local control of the associated devices. The Skill recommends storing device details, including tokens, in Markdown files under the project or Skill workspace. Markdown files do not provide secret-specific access controls and may be included in version control, backups, workspace indexing, diagnostic bundles, or Agent context. The example workflows also pass tokens through the `--token` command-line argument. Depending on the operating system and execution environment, command-line arguments may be observable through process inspection, command history, audit logs, debugging output, task telemetry, or Agent transcripts. This han ...[truncated 2353 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store device tokens in Markdown files or other workspace documents. 2. Use an operating-system credential manager, hardware-backed secret store, or dedicated secret-management service. 3. If file-based storage is unavoidable, use a separate configuration file with restrictive permissions, such as owner-only access, and exclude it from version control, backups, indexing, and diagnostic collection where possible. 4. Add relevant secret files to `.gitignore` and provide only redacted example configuration files. 5. Avoid passing tokens directly in command-line arguments. Prefer a supported environment-variable, protected file-descriptor, standard-input, or credential-helper mechanism that does not expose the value in the process list. 6. Ensure command output, logs, error reports, and Agent transcripts redact token values. 7. Restrict network access so Xiaomi devices are reachable only from authorized hosts or a dedicated IoT network segment. 8. Rotate any token that may already have been committed, logged, backed up, or included in an Agent conversation. 9. Either include the documented token extractor for a separate security review or remove the unsupported claim. If an extractor is later added, it must use authenticated TLS, transmit credentials only to documented Xiaomi endpoints, avoid logging account credentials or tokens, and request explicit user consent before cloud access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs users to run a bundled token-extraction script to retrieve Xiaomi device IPs and 32-byte tokens, but it does not warn that these are sensitive credentials that enable direct control of devices on the LAN. Exposing or mishandling those tokens can let anyone with access to them issue commands to physical devices, expanding risk beyond ordinary account metadata.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The natural-language examples map simple user phrases directly to miiocli commands that change real device state, including powering appliances on and off, without warning that these actions affect physical equipment. In a home-automation context, omitted safety guidance increases the chance of unintended actuation of devices such as heaters, humidifiers, or cookers, which can create property damage or safety issues.

Static analysis

No suspicious patterns detected.