Security audit

Xiaomi

Security checks for vulnerabilities and agentic risk

Overview

This Xiaomi home-control skill is purpose-aligned, but it needs Review because it encourages plaintext device-token storage and direct appliance control without clear safeguards.

Before installing, treat Xiaomi device tokens like passwords. Do not commit or share real tokens in Markdown files; prefer a secret manager, ignored private config file, or owner-only permissions. Use explicit confirmations and carefully verified device names before allowing power or appliance changes, especially for heaters, plugs, cookers, or similar devices. Consider pinning and reviewing the python-miio and click versions before running the install command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Third-Party Packages Are Installed from a Mutable Package Index
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:25
Finding: Xiaomi Device-Control Tokens Are Directed into Plaintext Markdown Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs users to run a token extraction script to retrieve Xiaomi Cloud device IPs and 32-byte local tokens, which are effectively credentials for controlling devices on the LAN. Presenting this without any warning about credential sensitivity, secure storage, or least-privilege handling increases the risk of accidental disclosure and unauthorized device control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill tells users to place device details into local reference files, but those details include LAN IPs and authentication tokens that enable direct device access. Encouraging plaintext storage in documentation-style files without sensitivity labeling or access-control guidance makes credential leakage through backups, screenshots, repo commits, or local multi-user access much more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language intent mapping includes commands that directly change the state of physical appliances, including a water heater and other home devices, without any warning, confirmation, or safety constraints. In this context, silent execution can cause unintended actuation, property damage, or unsafe operation if the wrong device is targeted or commands are triggered accidentally.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.