Camsnap 1.0.0

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:52 AM UTC
• Version: 1.0.0

Overview

This camera-capture skill is coherent, but it relies on an unpinned third-party executable and gives weak guidance around camera passwords and retained media.

Review this before installing. Use a dedicated low-privilege camera account, avoid putting real camera passwords in reusable command history or shared transcripts, protect any camsnap config file with restrictive permissions, and save snapshots or clips only to controlled locations. The Homebrew dependency comes from a third-party tap and is not pinned by this skill, so installation trust depends on that upstream package source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Executable Installed from a Third-Party Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml metadata: {"clawdbot":{"emoji":"📸","requires":{"bins":["camsnap"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/camsnap","bins":["camsnap"],"label":"Install camsnap (brew)"}]}} ``` ### Technical Analysis The skill installs the `camsnap` executable from the third-party Homebrew tap `steipete/tap` without specifying an immutable version, source commit, package checksum, or signature. Consequently, the code installed at a later date may differ from the dependency that existed when the skill was reviewed. The project contains only documentation and metadata; it does not include the executable's source code. The behavior and security properties of the installed binary therefore cannot be independently verified from this artifact. This represents a supply-chain weakness rather than evidence that the current upstream package is malicious. ### Attack Path 1. An attacker compromises the third-party tap, its maintainer account, release infrastructure, or an upstream artifact referenced by the formula. 2. The attacker modifies the formula or distributed package while retaining the expected package name. 3. A user installs the skill dependency using the unpinned `steipete/tap/camsnap` formula. 4. Homebrew downloads and installs the modified executable. 5. The executable runs with the invoking user's privileges when the skill uses it. 6. The compromised executable can access resources available to that user, potentially including camera configuration, credentials, captured images, and video. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user installing or invoking `camsnap`. The affected scope may include user-readable files, camera credentials, camera network access, and generated media. Ad ...[truncated 171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the dependency to an immutable and reviewed release rather than an automatically changing formula. - Verify downloaded artifacts using a cryptographic checksum or trusted signature. - Document the authoritative source repository and release provenance. - Prefer a trusted package source with reproducible builds and auditable release procedures. - Audit or vendor the executable source where feasible so its behavior falls within the project review boundary. - Establish an update process that reviews dependency changes before advancing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13
• Finding: Camera Password Passed in Plaintext Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13` **Vulnerability Type**: Plaintext credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - Add camera: `camsnap add --name kitchen --host 192.168.0.10 --user user --pass pass` ``` ### Technical Analysis The documented setup command instructs users to provide the camera password through the `--pass` command-line argument. When a real password replaces the example value, the credential may be exposed through shell history, process inspection facilities, terminal or agent transcripts, debugging output, command auditing, and telemetry. Command-line arguments may be observable by other local processes or users depending on operating-system controls. Even when process visibility is restricted, the command can persist in shell history or execution logs after the process exits. The example contains a placeholder rather than a hardcoded production credential. The vulnerability is the recommended credential-handling pattern. ### Attack Path 1. A user replaces `pass` with a real camera password and runs the documented command. 2. The shell records the complete command in history, or the operating system temporarily exposes it as part of the process argument vector. 3. A local user, monitoring process, logging service, terminal recorder, or agent transcript collector obtains the command. 4. The observer extracts the username, camera address, and plaintext password. 5. The recovered credentials are used to connect to the camera through its supported RTSP, ONVIF, or administrative interface. ### Impact Assessment Successful exploitation may disclose credentials for the configured camera. Depending on the camera account's permissions and network reachability, an attacker could view live streams, retrieve media, alter camera settings, or impersonate the legitimate user. The issue does not independently provide operating-system p ...[truncated 118 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the `--pass` argument workflow with an interactive password prompt that disables terminal echo. - Support reading the secret from standard input or an appropriately secured file descriptor. - Integrate with an operating-system keychain or dedicated secret manager for persistent credential storage. - If a configuration file must contain credentials, enforce restrictive permissions and clearly document the residual plaintext-storage risk. - Avoid placing real passwords in command examples, shell history, logs, error messages, or agent transcripts. - Add redaction controls for diagnostic output and telemetry. - Recommend a dedicated, least-privileged camera account with a unique password. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to add cameras with `--user` and `--pass` and notes a persistent config file path, but it does not warn that camera credentials will be stored and reused from disk. This can expose sensitive surveillance access if the config file is left with weak permissions, synced, backed up insecurely, or inspected by other local users or tools.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The examples for `snap` and `clip` write image and video files to user-specified paths, but the skill does not warn that captured media is persisted to disk. This can lead to unintended retention of sensitive camera footage, especially on shared machines, synced folders, or automated agent workflows that may later expose those files.

Static analysis

No suspicious patterns detected.