Security audit

Yzl Aiot

Security checks across malware telemetry and agentic risk

Overview

This skill appears intended for AIoT device management, but it can directly open or close real valves from broad natural-language commands without a confirmation step.

Review this before installing if it will connect to real equipment. Use it only with an API key scoped to devices you are authorized to control, verify the target device before issuing commands, and avoid broad natural-language valve commands unless you are comfortable with immediate physical actuation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill performs outbound network access to a third-party registry unrelated to its core AIoT device-management function. Even if intended for update awareness, this expands the trust boundary, leaks usage metadata such as IP address and timing, and creates undeclared external dependencies that could be abused if the registry or network path is compromised.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The code automatically calls the version-check routine during normal execution, causing undeclared network traffic on routine device operations. This is risky because a device-control skill should not silently contact unrelated infrastructure every time it runs, especially in sensitive operational environments where outbound traffic and metadata disclosure matter.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation wording is broad and conversational, which can cause unintended invocation in ordinary speech. In a skill that can query devices and issue control commands, ambiguous triggers increase the risk of accidental execution, especially when combined with natural-language parsing of sensitive actions.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example phrases include common requests like opening or closing a valve, which are easy to say inadvertently or be misinterpreted by an assistant. Because these commands can change the state of real-world equipment, ambiguous examples materially increase the chance of unintended physical actions.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill enables remote control of physical devices like valves but does not warn users about real-world consequences or mention confirmation requirements. Without explicit safety messaging and confirmation, accidental or coerced commands could trigger water flow changes or operational disruption in a physical environment.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The manual examples show how to send open/close commands directly to a remote valve without any cautionary notes. Even though the commands are intended administrative operations, presenting them without safety context normalizes direct actuation and can lead to misuse or operator error.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The command-sending function can issue actuator instructions directly without any interactive confirmation, safety prompt, or policy gate. In an AI agent context, this increases the chance of accidental or prompt-induced physical actions being executed immediately against real devices.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The natural-language smart command path can open or close a valve based on simple keyword matching and then immediately sends the device command. This is particularly dangerous because ambiguous language, prompt injection through upstream agent workflows, or user misunderstanding could trigger physical actuation with no confirmation, target selection review, or safety interlock.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.