Security audit

yzl-iot-api

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed IoT controller, but it can directly actuate remote water valves from loose natural-language or generic commands without an evident confirmation step.

Review before installing. Only use this skill in an environment where the YZL API key is intentionally allowed to control the relevant devices, and avoid exposing it to unattended or ambiguous natural-language automation. Treat valve commands as real-world physical actions; test with noncritical devices and prefer explicit manual commands or an updated replacement skill with confirmations and tighter command scoping.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The natural-language examples are broad, everyday phrases like '打开电磁阀' and '关闭水阀' that could be triggered in ordinary conversation without strong scoping. In this skill context, those phrases can actuate physical IoT devices, so accidental invocation may cause unintended water flow, equipment state changes, or operational disruption.

Vague Triggers

Low

Confidence: 78% confidence
Finding: Advertising 'one sentence' operation without defining trigger boundaries encourages ambiguous invocation and masks the difference between informational requests and control actions. In an IoT control skill, this ambiguity increases the chance that ordinary language is interpreted as an actionable command.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The documentation promotes simple voice-like commands that can remotely open or close valves, but does not prominently warn users that these are physical actuation commands with real-world consequences. Missing safety messaging is dangerous here because the affected devices are water-control components, where unintended activation can cause flooding, crop damage, or service interruption.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill states that it silently performs outbound version checks on each run and caches results, but does not provide a clear privacy/connectivity warning or opt-out. While likely intended as maintenance guidance, undisclosed background network behavior reduces user awareness and can leak metadata such as installation usage timing or environment network reachability.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The natural-language smart handler can directly open or close a valve based on loose keyword matching, without any confirmation prompt, authorization gate, or safety interlock. In an IoT context this can trigger physical-world effects such as unwanted water flow, equipment damage, or operational disruption from ambiguous or accidental input.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The generic send command allows arbitrary remote command execution on devices with caller-supplied type and arguments, but presents no user-facing warning or policy restriction. This broad control surface can be used to change device state or behavior unexpectedly, making accidental misuse or harmful automation much more likely.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.