T09 · Insecure Skill Coding Practices
Error
- Location
config.json:3- Finding
Long-Lived Home Assistant Token Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
xiaomi-home-assistant-skill
Security checks for vulnerabilities and agentic risk
Overview
This smart-home skill is mostly a Home Assistant integration, but it under-discloses device-control automation and encourages insecure handling of a powerful Home Assistant token.
Review this carefully before installing. Use HTTPS only, restrict the Home Assistant token to the minimum possible permissions, rotate any token previously used over HTTP, and do not enable the control or scenario handlers unless you are comfortable with the skill changing lights, curtains, and other devices without its own confirmation layer.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
manifest.json:14- Finding
Unbounded Third-Party Dependency Versions
- Content
View full analysis
=0.1.0", "python": { "requests": "*" } } ``` ### Technical Analysis The `requests` dependency accepts any version through the wildcard constraint, while the `openclaw` dependency accepts every version at or above `0.1.0` without an upper compatibility boundary. This makes dependency resolution non-reproducible: two installations of the same Skill version may receive materially different dependency code. The audit did not identify a currently malicious package or a demonstrated dependency-confusion package. The vulnerability is the absence of version integrity controls. A future compromised, vulnerable, or incompatible release could be installed automatically without a corresponding review of the Skill. This is particularly significant because dependency code executes in the same process as handlers that read the Home Assistant bearer token and issue physical-device control requests. ### Attack Path 1. The Skill is installed or its dependencies are refreshed. 2. The package resolver evaluates `requests: "*"` or `openclaw: ">=0.1.0"`. 3. A newer vulnerable or compromised release is available and satisfies the unrestricted constraint. 4. The runtime installs that release without requiring a change to the audited Skill source. 5. The dependency executes in the Skill’s process during import or normal operation. 6. Malicious dependency code can access process data, loaded configuration, API credentials, and network operations available to the Skill. This exploitation path is conditional on compromise or vulnerability of an accepted dependency release; no such compromise was established by this static audit. ### Impact Assessment Code executing through a compromised dependency would inherit the Skill process’s effective ...[truncated 652 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation frames the skill as monitoring and suggestions, while the behavior reportedly includes active automation and multi-step scene execution such as arrival or bedtime routines. Hidden automation capability can trigger broad real-world changes from a seemingly low-risk skill, making the mismatch especially dangerous in a home environment with physical devices.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation frames the skill as monitoring and suggestions, while the behavior reportedly includes active automation and multi-step scene execution such as arrival or bedtime routines. Hidden automation capability can trigger broad real-world changes from a seemingly low-risk skill, making the mismatch especially dangerous in a home environment with physical devices.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation frames the skill as monitoring and suggestions, while the behavior reportedly includes active automation and multi-step scene execution such as arrival or bedtime routines. Hidden automation capability can trigger broad real-world changes from a seemingly low-risk skill, making the mismatch especially dangerous in a home environment with physical devices.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation frames the skill as monitoring and suggestions, while the behavior reportedly includes active automation and multi-step scene execution such as arrival or bedtime routines. Hidden automation capability can trigger broad real-world changes from a seemingly low-risk skill, making the mismatch especially dangerous in a home environment with physical devices.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code can issue Home Assistant service calls that actively control devices, but the skill metadata describes only monitoring, status queries, alerts, and advice. This capability mismatch is dangerous because users or reviewers may grant the skill trust and secrets under a read-only expectation while the code can perform physical actions such as toggling lights or curtains.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
该技能说明全文使用中文，且没有说明这是面向中文用户的区域性技能，也没有提供语言切换或用户选择。按规则，若技能强制特定语言而无用户选择或明确合理的区域限定，可构成自然语言策略违规。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documentation defines operational capabilities and required files, but it does not declare an explicit tool scope such as permissions or allowed-tools. In a skill that reads local files and makes HTTP requests to Home Assistant, missing scope declarations weakens least-privilege controls and can cause users or runners to underestimate what the skill can access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation includes examples like turning on devices but does not warn that the skill can cause real-world state changes in the home. Without safety messaging or confirmation requirements, users may issue commands casually and unintentionally affect power-consuming or safety-relevant devices.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This JSON manifest defines natural-language command mappings such as light and curtain names, but it does not specify what exact trigger phrases activate the skill or what phrases should not. Without clear activation constraints or negative examples, ordinary household language referring to these devices could ambiguously invoke the skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language command keys are exclusively in Chinese, which suggests the skill expects a specific language/locale for operation. There is no accompanying indication of user opt-in, multilingual support, or justification that the skill is intentionally region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The code reads a sensitive credential from configuration and uses it in Authorization headers for outbound requests. There is no confirmation prompt, logging, comment warning, or other user disclosure indicating that credentials and home-environment data will be sent over the network.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The top-level docstring and later method docstring emphasize a 'safe silent monitoring handler' that does not write files and only returns in-memory results. In practice, the code performs disk reads for configuration and actively fetches multiple device states from Home Assistant, including a door lock, which goes beyond the narrow implication of purely in-memory handling. The documentation is therefore materially misleading about what the code actually does.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest claims that all data processing is completed in memory and that sensitive information is not persisted. However, this code explicitly loads Home Assistant configuration, including a token used later for API access, from a JSON file on disk. That is a meaningful behavior mismatch because the implementation depends on persisted sensitive configuration rather than purely in-memory handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code performs multiple authenticated network requests to a Home Assistant server and retrieves sensitive smart-home data such as door-lock and occupancy-related device states. Although the module has internal comments/docstrings, it lacks any user-facing warning, confirmation, or visible notice that household telemetry is being queried and transmitted over the network.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring explicitly says it handles natural language commands for smart home control, which contradicts the monitoring-only description in the skill metadata. This inconsistency is a security-relevant transparency issue because it obscures the true behavior of the skill and makes dangerous capabilities easier to hide in plain sight.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill loads a Home Assistant bearer token and prepares authenticated headers for API use without any visible disclosure, consent flow, or privilege scoping in this file. In the context of a smart-home skill, silent use of a powerful automation token increases risk because compromise or misuse can expose device state and enable unauthorized actions across the home environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code sends authenticated HTTP requests containing entity identifiers and service commands to Home Assistant without any explicit user-facing notice in the implementation context provided. While communication with Home Assistant is expected for this type of skill, undisclosed transmission of device identifiers and control requests is still security-sensitive because it involves private home topology and potentially safety-affecting actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
This code performs external network transmission to a Home Assistant API endpoint, including authenticated headers and JSON command data. External transmission is expected for an integration skill, but it remains security-relevant here because the payload can trigger physical device actions and expose device identifiers; combined with the manifest mismatch, the transmission is more dangerous than ordinary telemetry.
- Content
python data.update(kwargs) try: response = requests.post(url, headers=self.headers, json=data, timeout=10) return response.status_code == 200 except Exception as e: print(f"Error executing service: {e}")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language command mappings are exclusively Chinese phrases, which imposes a specific language requirement on users. There is no opt-in, fallback, or documentation indicating that this is intentionally limited to a Chinese-language environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata says it provides monitoring, status queries, and smart suggestions, but this code performs authenticated Home Assistant service calls that directly change device state. That mismatch is risky because users or reviewers may grant trust expecting passive observation while the skill can actively operate switches and covers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
execute_service() issues authenticated state-changing requests without any built-in confirmation, warning, or policy check. In a smart-home setting, silent execution can trigger unintended device operations, especially if upstream intent parsing is wrong or the call path is abused.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python data.update(kwargs) try: response = requests.post(url, headers=self.headers, json=data, timeout=10) return response.status_code == 200 except Exception as e: print(f"Error executing service: {e}")
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The scenario methods do more than provide recommendations: they automatically turn devices on or off and move covers. In a home-automation context, undisclosed actuation expands the skill's authority and can surprise users, causing privacy, safety, or operational issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This scenario performs an immediate actuator command and only informs the user after the fact. In a physical environment, post-action messaging removes the user's chance to prevent an unintended change and increases risk from accidental or misinterpreted triggers.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language content of the skill file is fully Chinese, and there is no indication that users can choose another language or that the locale restriction is intentional and documented as a region-specific constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content