TRÅDFRI Lights

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:03 AM UTC
• Version: 0.2.0

Overview

The skill appears purpose-built for local IKEA TRÅDFRI light control, but its setup can expose reusable gateway credentials in terminal or agent logs.

Review before installing if an agent will run setup commands for you. Keep the gateway PSK out of chat and logs, remove or avoid the console.log(result) setup pattern, store config.json with owner-only permissions, and only use whole-house commands when you intend to change all configured lights.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup.md:21

Finding

Gateway Credentials Exposed in Plaintext During Authentication Setup

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 21-27
Vulnerability Type: Plaintext disclosure of reusable gateway credentials
Risk Level: Medium

Complete Code Snippet:

js

const { TradfriClient } = require('node-tradfri-client');
const tradfri = new TradfriClient('YOUR_GATEWAY_HOST');
const result = await tradfri.authenticate(SECURITY_CODE);
console.log(result);

The instructions then direct the user to store the returned values in config.json.

Technical Analysis

TradfriClient.authenticate() returns authentication material that includes the gateway identity and pre-shared key. The documented example prints the entire returned object with console.log(result). Consequently, reusable credentials may be exposed in terminal output, command transcripts, CI or automation logs, session recordings, or Agent-visible tool output.

The documentation also instructs users to place the returned credentials in config.json, but it does not prescribe restrictive file permissions or a secret-management mechanism. Although the distributed config.json contains placeholders rather than real credentials, users following the setup procedure may create a plaintext credential file readable beyond the intended account.

Attack Path

1. A user or automation agent follows the authentication procedure in references/setup.md.
2. The gateway returns an identity and PSK through tradfri.authenticate(SECURITY_CODE).
3. console.log(result) writes the complete authentication result to standard output.
4. Terminal logging, session capture, automation infrastructure, an Agent transcript, or another party with access to the output obtains the identity and PSK.
5. Alternatively, an unauthorized local user reads the populated config.json if its permissions are insufficiently restrictive.
6. The attacker reuses the credentials from a host that can reach the local TRÅDFRI gateway.
7. The a ...[truncated 852 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove console.log(result) from the authentication example so the complete authentication object is never emitted to standard output.
2. Persist the returned identity and PSK directly to a protected secret store or configuration file rather than passing them through logs or chat output.
3. When creating a local credential file, use owner-only permissions such as mode 0600, and verify that parent directories are not accessible to unauthorized users.
4. Prefer an operating-system secret manager or securely injected environment variables where available.
5. If any confirmation output is necessary, display only a success message or heavily redacted values; never print the PSK.
6. Add config.json to .gitignore when it may contain real credentials, and provide a separate placeholder file such as config.example.json.
7. Update the setup documentation to warn users not to paste authentication results into chat, issue trackers, CI logs, or other retained transcripts.
8. Rotate the gateway credentials if the authentication result has already been logged or otherwise disclosed.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation indicates access to environment variables for sensitive gateway credentials (TRADFRI_HOST, TRADFRI_IDENTITY, TRADFRI_PSK) and instructs running local scripts, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, undeclared environment access can lead to unintended credential exposure or broader runtime access than reviewers and users expect, especially because this skill manages home automation actions on a local network.

Content

No source excerpt is available for this finding.