yzl-aiot

• Outcome: Review
• Latest audit: Oct 17, 2026 · 5:14 PM UTC
• Version: 1.2.1

Overview

The skill mostly matches its AIoT purpose, but it can control physical devices without confirmation and ships an unrelated repository-sync script that can push local files using developer tokens.

Review before installing. Use this only with an authorized YZLIOT_API_KEY and require your agent to ask for explicit confirmation before any valve or switch command. Do not run sync.sh unless you intentionally want to publish the repository and have reviewed every file that git would stage and push.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is AIoT device management, but the static finding indicates the actual behavior performs Git operations, reads credentials, and pushes to external code hosting services while containing no matching AIoT API functionality. That mismatch is a strong indicator of deceptive packaging or repurposed code, creating a serious risk of credential theft, unauthorized code exfiltration, or abuse of developer infrastructure under a benign-looking description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README includes an example command that performs remote device control (send ... SetFac ...) but does not clearly warn users that executing control actions can change the state of physical equipment in the real world. In an AI-agent context, this omission increases the chance of accidental or poorly understood actuation, especially since the skill is explicitly designed for one-shot natural-language control of IoT devices.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares runtime requirements and implies access to environment variables and networked operations, but it does not define an explicit tool scope such as allowed tools or permissions. In a skill that can send device-control commands and perform outbound requests, missing scope boundaries increases the chance of over-broad execution privileges, unintended file access, or misuse of secrets like the API key.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Broad natural-language triggers like requests to 'get sensor data' or 'open the valve' lack strong activation boundaries and can overlap with ordinary conversation. In a skill that can issue real-world control commands to devices, accidental invocation could cause unintended actuation or data disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example phrases are generic enough to be spoken casually in conversation, increasing the risk of unintended skill activation. Because this skill can control physical devices, ambiguous triggers are more dangerous than in a read-only skill and may lead to accidental operational changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script automatically stages all changes, commits them, reads local credentials, and pushes to external repositories. In the context of an AIoT device-management skill, this behavior is unrelated to the declared functionality and creates a clear data-exfiltration path: any local files accidentally added to the repo can be transmitted off-host using stored tokens.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sources sensitive credentials from environment variables or a local token file without strong safeguards or clear separation from distributed skill content. This increases the risk of credential misuse, accidental disclosure, or reuse by anyone who can run or modify the script, especially because the credentials are then embedded into command-line git URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs git add -A, commit, and remote push automatically, with no review of what files are being included and no explicit warning about the transmission scope. If executed in a working tree containing secrets, internal configs, or unrelated changes, it can unintentionally publish sensitive data to remote hosting services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

User-facing docstrings, help text, prompts, and command guidance are written entirely in Chinese, and the natural-language command path specifically detects Chinese characters for invocation. This imposes a locale/language constraint without presenting it as an explicit opt-in or justified region-specific limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Natural-language parsing can directly trigger physical device control actions such as opening or closing a valve without an explicit confirmation step. In an AIoT context controlling actuators, ambiguous or prompt-injected user text could cause unintended state changes with real-world consequences such as water flow, equipment damage, or safety incidents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file uses Chinese throughout, including headings and operational notes, but does not indicate that the skill is region-specific or that users may choose another language. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README content, headings, instructions, and warnings are all presented in Chinese, which effectively forces a specific language for users. Under the stated policy, language constraints should either be optional for the user or clearly documented as a justified locale-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The description specifies invocation and usage entirely in Chinese, including the activation phrase, without indicating that other languages are supported or that Chinese is a user-selected preference. This can violate a language/locale policy when a skill implicitly forces one language for all users without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatic outbound version checking introduces an extra network capability unrelated to the core device-management action path. While not inherently malicious, it expands the skill's data flow and attack surface, can leak usage metadata, and creates a dependency on a third-party service without clear user opt-in.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · tool.py (reported line 88)May include surrounding context.

python

统一将 stdout/stderr 切换为 UTF-8（失败时忽略），保证跨平台可运行。
    """
    for name in ("stdout", "stderr"):
        stream = getattr(sys, name, None)
        try:
            stream.reconfigure(encoding="utf-8", errors="replace")
        except Exception:

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill performs outbound network access to a third-party registry for self-version checking that is not required for core AIoT device management. Extra remote connectivity expands the attack surface, can leak usage metadata such as IP/user-agent/timing, and introduces trust in remote content for update signaling during normal tool execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.