Android IP Webcam monitoring and alert

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:36 PM UTC
• Version: 1.0.0

Overview

The skill fits its camera-monitoring purpose, but it needs review because it handles sensitive camera, audio, and device-control access without enough security and privacy boundaries.

Install only if you can keep the camera endpoint on a trusted local network, enable authentication where available, avoid public port forwarding, and are comfortable with alert images being sent to an AI service. Review or add clear start/stop controls before using any background monitoring loop.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:21
• Finding: Plaintext Access to Sensitive Camera and Device-Control APIs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21–54 **Vulnerability Type**: Sensitive surveillance and device-control endpoints accessed over plaintext HTTP without documented authentication or network-access restrictions **Risk Level**: Medium ### Vulnerable Code ```markdown Base URL: `http://<IP>:8080/` ### Visual Captures - **Standard Snapshot**: `/shot.jpg` (Fastest, current frame) - **Autofocus Snapshot**: `/photoaf.jpg` (Triggers autofocus before capture, highest quality) - **Video Recording**: - Start: `/startvideo?name=alert_123` - Stop: `/stopvideo` - List recordings: `/list_videos` (returns JSON/HTML) - Download: `/v/<filename>.mp4` ### Camera Control & Settings - **Focus Distance**: `/settings/focus_distance?set=<0.0-10.0>` (0.0 is often Infinity) - **Torch (Flash)**: `/enabletorch` | `/disabletorch` - **Focus Mode**: `/settings/focusmode?set=<on|off|macro|infinity|fixed>` - **Scene Mode**: `/settings/scenemode?set=<auto|night|action|party...>` - **White Balance**: `/settings/whitebalance?set=<auto|daylight|cloudy...>` ### Device Telemetry - **Sensors Data**: `/sensors.json` (Battery, light level, proximity, accelerometer) - **System Status**: `/status.json` (Camera state, recording status, uptime) ### Audio - **Audio Feed**: `/audio.wav` or `/audio.opus` (Live audio stream) ### Integration Examples (curl) ```bash # Get battery level via jq curl -s http://<IP>:8080/sensors.json | jq '.battery_level[0][1][0]' # Toggle flash remotely curl http://<IP>:8080/enabletorch ``` ``` ### Technical Analysis The Skill instructs users to access sensitive IP Webcam interfaces through unencrypted HTTP. The supplied `curl` examples do not use credentials, authentication headers, certificate validation, an encrypted tunnel, or any other access-control mechanism. These interfaces provide access to live images, live audio, stored recordings, sensor telemetry, video-recording controls, the torch, and camera settings. Plaintext ...[truncated 2247 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enable IP Webcam authentication and require a unique, high-entropy password before allowing any client access. 2. Do not expose port 8080 directly to the public Internet or configure unauthenticated router port forwarding. 3. Restrict inbound access using host firewall rules, router ACLs, or a dedicated VLAN that permits only the OpenClaw host to contact the camera. 4. Protect traffic with an authenticated encrypted tunnel, such as WireGuard, or an HTTPS reverse proxy with valid certificate verification and access control. 5. Where supported, bind the camera service only to a trusted network interface rather than all available interfaces. 6. Update examples to use a protected URL and secure credential handling. Credentials should be read from a permission-restricted secret store or environment variable and must not be embedded in the Skill, committed to source control, or exposed in shell history. 7. Add explicit setup validation that rejects publicly routable camera addresses and warns when authentication or transport encryption is unavailable. 8. Limit access to audio, stored recordings, sensor telemetry, and state-changing endpoints unless each capability is required. 9. Document recording retention, AI-upload destinations, user consent, and deletion controls for alert-triggered frames. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill describes capabilities, setup, and supporting scripts, but does not define when or under what user action it should activate. In a security-monitoring context, ambiguous invocation can cause the agent to run network-facing camera interactions or background monitoring unexpectedly, increasing the chance of unintended surveillance or unauthorized data collection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that alert-triggered frames are sent to an AI, but does not clearly disclose that sensitive camera images may leave the local device or environment. Because this is a home/security camera use case, the transmitted frames may contain people, interiors, or other sensitive information, creating meaningful privacy and compliance risk if users are not clearly informed and given control.

Static analysis

No suspicious patterns detected.