Security audit

yzl-iot-api

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed IoT control tool, but it can open or close real-world water valves from broad natural-language commands without an explicit confirmation or device-specific selection.

Install only if you are comfortable letting the assistant control YZL IoT devices, including water valves. Use it in contexts where valve commands are deliberate, and prefer explicit manual commands with device IDs; review access to YZLIOT_API_KEY and be aware that each run may check ClawHub for version information.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises runtime requirements and behavior implying environment access, file reads/writes, and network use, but does not declare an explicit tool/permission scope. This weakens least-privilege controls and makes it harder for users or the host platform to understand and constrain what the skill can access, especially since it performs outbound requests and caches update checks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill enables remote opening and closing of water valves but does not prominently warn users that it can alter physical infrastructure state. Absent a clear warning and confirmation expectations, users may not appreciate that a simple natural-language command can trigger consequential real-world actions such as irrigation changes, water loss, or equipment stress.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are broad everyday commands like '获取液位' and '打开电磁阀', which can be matched during ordinary conversation and cause the assistant to invoke the skill unexpectedly. Because this skill can send remote control commands to physical devices, accidental activation could change real-world system state without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The natural-language examples use casual phrases such as '帮我看看传感器数据' and '关闭水阀', which are ambiguous in normal conversation but map directly to device reads and control actions. In a voice or chat assistant context, this raises the risk of unintended skill execution and unauthorized physical actuation.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: User-facing strings, help text, and natural-language command handling are all fixed to Chinese, including the smart-command trigger logic that checks for Chinese input and specific Chinese keywords. This effectively forces a language/locale without presenting the user with a choice or documenting an explicit opt-in.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The smart command path can open or close a real-world valve based on loose natural-language matching and immediately sends the command without a user confirmation step. In an IoT/actuator context, unintended execution can cause physical consequences such as water flow, equipment damage, waste, or safety incidents, making this significantly more dangerous than ordinary API automation.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The documentation states that every run performs a silent outbound version check, but it does not clearly warn users up front that normal use generates network traffic beyond the core IoT API operations. Silent background requests can create privacy, policy, and surprise-behavior concerns, particularly in restricted or sensitive environments.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The skill's stated purpose is managing YZL IoT devices, but these functions persist a .version_cache.json file solely for marketplace version checking. Local file persistence for self-update metadata is ancillary behavior outside the declared device-management scope.

Description-Behavior Mismatch

Low

Confidence: 93% confidence
Finding: The manifest description scopes the skill to '云智联 IoT 设备管理API', which reasonably covers communicating with the IoT platform for device operations. However, this file additionally contacts the external ClawHub registry to check skill versions and migration status, which is not part of IoT device management itself.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: On startup, the skill contacts an external registry endpoint and writes a local .version_cache.json file, but this behavior is not disclosed in a user-facing warning within the code path that runs automatically. For safety/quality review, automatic network and file-write behavior should be visible to users unless clearly documented.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The manifest description only says the skill is an IoT device management API, but the implementation depends on reading YZLIOT_API_KEY from the host environment. While common for API clients, credential access is still a host-side capability not described in the manifest text provided.

Static analysis

No suspicious patterns detected.