Security audit

Blueair Expert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Blueair purifier integration that uses local credentials and cloud APIs to read and change purifier state, with some security hardening caveats but no evidence of hidden or malicious behavior.

Install only if you are comfortable giving the skill access to your Blueair account and purifier controls. Use a dedicated low-privilege Blueair account if available, restrict permissions on ~/.blueair/config.json, avoid running test-login unless needed because it prints device data, and require the agent to ask before changing purifier state, especially for bulk or inferred actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to run local Node.js CLI scripts and references stored credentials, which implies access to environment/config data and outbound network communication, yet no explicit permissions are declared. This creates a transparency and consent gap: an invoking user may believe they are using a simple advisory skill while the skill can access local state and communicate with vendor cloud services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest presents the skill primarily as an indoor air quality expert, but the instructions direct it to authenticate to cloud services, enumerate household device state, and remotely change purifier settings. That mismatch is dangerous because it obscures the true operational scope and can lead users to grant trust or credentials without realizing the skill performs account/device management actions.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This file implements Gigya authentication flows that are unrelated to the stated Blueair air-quality domain, which is a strong indicator of unnecessary identity-handling capability inside the skill. Even if not overtly malicious, collecting or transmitting account credentials and session artifacts outside the expected product scope expands attack surface and can enable covert account access or data misuse.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file implements a Gigya authentication client that handles usernames, passwords, session tokens, and JWT issuance, which is unrelated to the stated purpose of a Blueair indoor air-quality expert skill. The mismatch is a strong indicator of hidden account-access functionality or covert data collection, making the skill context substantially more dangerous rather than less.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The code accepts raw user credentials, exchanges them for a session, and then requests a JWT from an external identity provider without any justification tied to air-quality management. In this context, credential capture and token minting could enable account takeover, unauthorized API access, or silent impersonation of users.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file implements third-party identity authentication and token retrieval against Gigya, which is materially unrelated to the declared air-quality expert purpose of the skill. That domain mismatch is dangerous because it creates hidden account-access capability inside a skill users would reasonably expect to handle only purifier or air-quality functions, increasing the risk of credential misuse or unauthorized account actions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code accepts a username and password, performs an accounts.login call, and then exchanges the resulting session for a JWT. In an air-quality skill context, this is an unjustified credential and token acquisition capability that could enable covert account access, session creation, or downstream API abuse far outside the expected domain behavior.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill reads Blueair credentials from ~/.blueair/config.json and environment variables, but the declared skill purpose is framed as an indoor-air-quality expert rather than a credential-using device-integration. This creates a scope/transparency problem: users or hosting agents may invoke the skill without realizing it will access local secrets and authenticate to a remote account.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script automatically loads Blueair credentials from a local config file or environment variables and then uses them to perform account actions, despite the skill being ներկայացված as a domain expert for air quality rather than an account/device-control tool. This creates an unjustified credential-access capability and increases the risk of unauthorized account use if the skill is invoked in a broader agent context.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script accepts arbitrary command-line values for device UUID, attribute, and value, then forwards them directly to setDeviceStatus without allowlisting safe attributes or validating intended operations. In the context of a skill described as air-quality expertise and complaint response, this hidden arbitrary state-mutation capability is over-privileged and could be abused to change purifier behavior in unintended or unsafe ways.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: This script performs a direct state-changing operation on a Blueair device via `setDeviceStatus(uuid, attribute, value)` based solely on command-line input, while the skill description emphasizes management, air-quality checking, and respiratory complaint response without clearly disclosing arbitrary write/control capability. That mismatch increases the risk of users or higher-level agents invoking device-modifying actions they did not expect, which can change purifier behavior, disable protections, or degrade indoor air quality.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: This script reads persisted Blueair credentials from a file in the user's home directory and uses them to authenticate to a remote service. Even though it appears to be a test utility, accessing local account secrets is a sensitive capability that is not aligned with the stated domain-expert purpose, and it increases the risk of unintended credential use or abuse if the skill/package is executed in a user environment.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The example utterances are broad and map closely to ordinary conversation, which can cause accidental or overly eager skill activation. In this skill, unintended activation is more dangerous than a harmless mismatch because the skill can invoke local scripts that access cloud APIs and change purifier state, not just answer informational queries.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: Triggers such as "filter" and especially "stuffy" are broad everyday terms that can cause accidental activation in unrelated conversations, including health discussions. Because this skill can check status and potentially guide or initiate device control workflows using stored credentials, unintended invocation increases the chance of privacy exposure or unintended device operations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The install instructions tell users to create ~/.blueair/config.json for credentials but provide no guidance on secure storage, file permissions, encryption, or minimization of sensitive data. This encourages insecure credential handling on disk and raises the risk of account compromise if the file is exposed, copied, or read by other local processes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code sends username and password to a remote authentication endpoint and later exchanges session secrets for JWTs, but there is no visible user disclosure, consent boundary, or safeguard around this sensitive credential flow. Although HTTPS is used, silently transmitting credentials and tokens in a skill whose stated purpose is air purifier management is dangerous because users would not reasonably expect identity-provider authentication behavior in this context.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script reads a username and password from a plaintext config file in the user's home directory and uses them automatically without any warning, confirmation, or protection boundary. This increases the risk of credential exposure through insecure local storage, accidental reuse in test tooling, and silent authentication with sensitive account data, especially because the script also fetches device and status information after login.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: This example depicts the agent proactively placing multiple purifiers into Standby based on the ambiguous statement 'I'm heading to bed,' without obtaining explicit consent for each environmental change. In a home-environment skill, broad multi-device state changes can reduce air cleaning coverage unexpectedly, which may be unsafe for users with respiratory sensitivities or rooms that still need filtration.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The code transmits login credentials to a remote service as request parameters during the authentication call, yet there is no visible user disclosure, consent handling, or justification in the file. Even though the endpoint uses HTTPS, sending sensitive credentials to an external identity provider inside an unrelated skill increases the risk of secret exposure through logs, telemetry, misuse, or unauthorized backend behavior.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code forwards session tokens and secrets to obtain a JWT from a remote API without any visible disclosure or contextual need for an indoor air-quality skill. Handling and relaying these bearer-style credentials expands the attack surface and could allow replay, impersonation, or downstream access if tokens are exposed or misused.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code silently pulls credentials from local configuration and environment variables with no disclosure at tool invocation time. Even if this is common for integrations, undisclosed secret access increases the risk of unauthorized account use and violates least surprise for a skill described primarily as an air-quality expert.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The blueair_set_state tool performs live remote device control immediately, with no confirmation, authorization check, or safety interlock. An agent or prompt injection that reaches this tool could change purifier behavior such as power state or fan mode without the user's informed approval.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code silently reads credentials from ~/.blueair/config.json without any user-facing disclosure, consent, or warning, which is risky for a skill whose stated purpose does not imply secret retrieval. This undermines transparency and can lead to unexpected credential use in an agent environment where users may not realize local secrets are being consumed.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code loads stored username/password values and performs a live login with no user-facing disclosure, confirmation, or runtime consent. This is dangerous because users or operators may execute the script without realizing it will transmit persisted credentials to an external service, creating privacy, trust, and account-security risks if run in unintended environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This script logs full device and status payloads, and also prints account metadata such as the detected region and account UUID. In a real environment, console output is often captured by terminals, CI logs, shell history tooling, or centralized log collectors, which can expose sensitive household/device information to unintended parties.

Static analysis

No suspicious patterns detected.