iot-security
Secures IoT devices through firmware hardening, encrypted transport, strong authentication, and safe OTA updates to prevent vulnerabilities.
Install this skill
or
63/100
Security score
The iot-security skill was audited on Mar 1, 2026 and we found 11 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
medium line 62
Template literal with variable interpolation in command context
SourceSKILL.md
| 62 | headers: { 'Authorization': `Bearer ${process.env.IOT_API_KEY}` }, |
high line 88
Python subprocess execution
SourceSKILL.md
| 88 | For CLI, capture output: `result = subprocess.run(['iot-secure', 'harden', '--firmware', 'file.bin'], capture_output=True); if result.returncode != 0: log(result.stderr)`. Common errors: invalid API k |
medium line 100
Curl to non-GitHub URL
SourceSKILL.md
| 100 | ```curl |
low line 60
Fetch to external URL
SourceSKILL.md
| 60 | fetch('https://api.openclaw.io/api/iot/ota-update', { |
medium line 77
Webhook reference - potential data exfiltration
SourceSKILL.md
| 77 | Integrate this skill with other IoT tools by exporting configs as JSON files. For AWS IoT or Azure, map `$IOT_API_KEY` to their respective secrets managers. Use webhooks for real-time updates; e.g., P |
low line 62
Access to .env file
SourceSKILL.md
| 62 | headers: { 'Authorization': `Bearer ${process.env.IOT_API_KEY}` }, |
low line 46
External URL reference
SourceSKILL.md
| 46 | response = requests.post('https://api.openclaw.io/api/iot/encrypt-transport', json={"deviceId": "device123", "key": os.environ['IOT_API_KEY']}) |
low line 56
External URL reference
SourceSKILL.md
| 56 | Body: `{"firmwareUrl": "https://updates.example.com/firmware.bin", "signature": "hex-signature", "key": "$IOT_API_KEY"}` |
low line 60
External URL reference
SourceSKILL.md
| 60 | fetch('https://api.openclaw.io/api/iot/ota-update', { |
low line 63
External URL reference
SourceSKILL.md
| 63 | body: JSON.stringify({firmwareUrl: 'https://updates.example.com/firmware.bin'}) |
low line 101
External URL reference
SourceSKILL.md
| 101 | curl -X POST https://api.openclaw.io/api/iot/encrypt-transport -H "Authorization: Bearer $IOT_API_KEY" -d '{"deviceId": "sensor456", "protocol": "TLS1.3"}' |
Scanned on Mar 1, 2026
View Security Dashboard