xpai-camera-control

• Outcome: Review
• Latest audit: Oct 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

The skill largely matches its camera-control purpose, but it handles camera credentials and live camera access in ways that need careful review before installation.

Install only if you trust this skill with camera admin credentials and live camera access. Before using WebRTC preview, restrict it to localhost or a trusted network, rotate any credentials that may have appeared in chat/logs, and treat config.yaml, go2rtc.yaml, snapshots, videos, and events as sensitive files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/toolkit/stream.py:1157

Finding

Unauthenticated WebRTC bridge binds to all network interfaces

Content

View full analysis

Vulnerability Details

File Location: scripts/toolkit/stream.py:1157-1179
Vulnerability Type: Unauthenticated network exposure of camera streams and credentials
Risk Level: High

Vulnerable Code

python

rtsp_path = target.rtsp_sub_path if sub_stream else target.rtsp_path
rtsp_url = dm._build_rtsp_url(
    target.ip, target.rtsp_port, rtsp_path, target.username, target.password,
)

import yaml

config_path = _os.path.join(_GO2RTC_SKILL_DIR, "go2rtc.yaml")
stream_name = camera_name.replace(" ", "_")
go2rtc_config = {
    "streams": {stream_name: rtsp_url},
    "api": {"listen": f":{port}"},
}
with open(config_path, "w") as f:
    yaml.dump(go2rtc_config, f, default_flow_style=False, allow_unicode=True)

try:
    popen_kwargs = {
        "stdout": subprocess.PIPE,
        "stderr": subprocess.PIPE,
    }
    if _GO2RTC_IS_WIN:
        popen_kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW

    _go2rtc_process = subprocess.Popen(
        [binary, "-config", config_path],
        **popen_kwargs,
    )

Technical Analysis

start_webrtc_stream() constructs an authenticated RTSP URL containing the camera username and password, writes it to go2rtc.yaml, and starts go2rtc with an API listener configured as :<port>.

This listener syntax does not restrict the service to the loopback interface. Although the returned URL is described as http://localhost:<port>, the underlying service may be reachable through every host network interface. No authentication or access-control configuration is supplied to go2rtc.

The implementation therefore expands access from the user-local browser to other systems capable of reaching the host. It also leaves the credential-bearing RTSP URL in a plaintext configuration file under the Skill root.

Attack Path

1. The user starts a browser preview through start_webrtc_stream().
2. The function builds an RTSP URL containing ...[truncated 947 chars]

Remediation

View remediation

Remediation Suggestions

• Bind the go2rtc API explicitly to the loopback interface, such as 127.0.0.1:<port>.
• If remote access is an intended feature, require explicit user authorization and configure strong authentication and transport protection.
• Create go2rtc.yaml with owner-only permissions rather than relying on process-default permissions.
• Avoid persisting credential-bearing RTSP URLs where possible. Generate an ephemeral configuration or securely remove it when the stream stops.
• Validate that the selected port is not already exposed by firewall or port-forwarding rules.
• Return the actual bound address rather than presenting a localhost URL while listening on broader interfaces.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_server.py:452

Finding

Registered-camera tool returns decrypted camera credentials to the Agent

Content

View full analysis

Vulnerability Details

File Location: scripts/toolkit/device_mgmt.py:1818-1847; scripts/mcp_server.py:452-457,496-497
Vulnerability Type: Sensitive credential exposure through MCP tool output
Risk Level: Medium

Vulnerable Code

scripts/toolkit/device_mgmt.py reconstructs public camera configuration objects with decrypted secrets:

python

cameras.append(
    CameraConfig(
        name=entry.get("name", ""),
        connection_type=entry.get("connection_type", "onvif"),
        ip=entry.get("ip", ""),
        port=entry.get("onvif_port", entry.get("port", 0)),
        username=entry.get("username", "admin"),
        password=_dec(entry.get("password", "")),
        rtsp_port=entry.get("rtsp_port", 554),
        rtsp_path=entry.get("rtsp_path_main", entry.get("rtsp_path", "/md0_0")),
        rtsp_sub_path=entry.get("rtsp_path_sub", entry.get("rtsp_sub_path", "/md0_1")),
        device_class=entry.get("device_class", ""),
        sn_code=_dec(entry.get("sn_code", "")) or _dec(entry.get("sn", "")),
        pkdk=_dec(entry.get("pkdk", "")),
        protocol_type=entry.get("protocol_type", ""),
        onvif_sn=entry.get("onvif_sn", ""),
        illumination_modes=entry.get("illumination_modes", []) or [],
    )
)

scripts/mcp_server.py serializes every dataclass field and returns it to the MCP caller:

python

if hasattr(obj, "__dataclass_fields__"):
    return {
        f.name: _serialize(getattr(obj, f.name))
        for f in obj.__dataclass_fields__.values()
    }

python

if name == "get_registered_cameras":
    return _serialize(tk.get_registered_cameras())

Technical Analysis

Credentials are obfuscated in config.yaml, but _load_config_cameras() restores password, sn_code, and pkdk into a CameraConfig. The generic MCP serializer then includes every dataclass field without applying a secret-field denylist or a public respon ...[truncated 1731 chars]

Remediation

View remediation

Remediation Suggestions

• Define a dedicated public response type for get_registered_cameras() that omits password, sn_code, and pkdk.
• Do not use a generic serializer for objects containing secrets.
• Keep decrypted credentials inside the toolkit and resolve them internally only when connecting to a camera.
• Return a boolean such as has_cached_credentials when the Agent needs to know whether automatic authentication is available.
• Add defense-in-depth redaction at the MCP response boundary for fields named password, token, secret, sn_code, and pkdk.
• Review logs and traces produced by existing deployments for previously disclosed credentials and rotate affected camera passwords where necessary.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/mcp_server.py:487

Finding

Sensitive camera operations rely on documentation-only confirmation gates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:142-148; scripts/mcp_server.py:487-555
Vulnerability Type: Missing server-side authorization enforcement for privacy-sensitive and physical actions
Risk Level: Medium

Vulnerable Code

The Skill documentation requires confirmation:

markdown

## Security Constraints

- **Explicit prompt:** inform the user and wait for confirmation before PTZ,
  streaming, screenshots, event monitor start, and
  illumination/image/tracking changes.
- **Code validation:** tool-layer validation for recording and storage configuration.
- **Background threads:** event listeners start **only** after
  `events(action="start")`; auto-resume only re-arms previously-enabled listeners.

The executable dispatch path does not verify confirmation:

python

elif name in ("get_audio_video_stream", "capture_video_screenshot"):
    args = {k: v for k, v in args.items() if k != "timeout_seconds"}
    if name == "get_audio_video_stream":
        return _serialize(tk.get_audio_video_stream(**args))
    return _serialize(tk.capture_video_screenshot(**args))
elif name == "toggle_recording":
    args = dict(args)
    if "action" in args:
        args["action"] = RecordingAction(args["action"])
    return _serialize(tk.toggle_recording(**args))

python

elif name == "control_ptz":
    args = dict(args)
    if "direction" in args:
        args["direction"] = PTZDirection(args["direction"])
    return _serialize(tk.control_ptz(**args))

python

elif name == "manage_camera_events":
    args = dict(args)
    args.pop("protocols", None)
    args["action"] = EventAction(args["action"])
    return _serialize(tk.manage_camera_events(**args))

python

elif name == "manage_illumination":
    args = dict(args)
    args["action"] = IlluminationAction(args["action"])
    return _serialize(tk.manage_illumination(**args))

...[truncated 2090 chars]

Remediation

View remediation

Remediation Suggestions

• Implement a two-step prepare-and-confirm protocol in the MCP server.
• On preparation, return a short-lived nonce describing the camera, operation, parameters, and expected impact.
• Require the subsequent sensitive tool call to present that nonce and verify that it matches the exact operation and has not expired or been reused.
• Keep read-only status operations and emergency stop operations exempt where appropriate.
• Require fresh confirmation when parameters change, including camera name, PTZ direction, duration, output destination, or setting values.
• Store confirmation state only in the active MCP session and do not persist it across restarts.
• Require separately scoped confirmation before enabling persistent event-monitor auto-resume.
• Treat Agent-side prompts as explanatory user-interface controls, not as the sole authorization mechanism.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (81)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 52)May include surrounding context.

md

### `register_camera`

Persist camera credentials to `config.yaml`. Renaming is supported: when a new name is passed but the IP or SN matches an existing entry, the old name is replaced automatically. Usually called internally by `connect_device` / `search_devices`.

**Parameters**:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

The API includes a _display_instruction field explicitly intended to drive caller presentation behavior. Instruction-bearing fields from tool output can become a prompt-injection vector if the agent treats them as authoritative workflow guidance rather than untrusted data, especially in a skill that discovers devices and can influence follow-on actions.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 100)May include surrounding context.

md

| `success`              | bool               | Whether the search succeeded           |
| `devices`              | DiscoveredDevice[] | List of discovered devices             |
| `device_count`         | int                | Number of devices (additional field)   |
| `_display_instruction` | string             | Display instruction (additional field) |
| `error_message`        | string             | Failure reason                         |

**DiscoveredDevice fields**:

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow explicitly tells the agent to disclose a live RTSP URL with embedded credentials to the user, which is a direct secret-handling flaw. Because this skill manages LAN cameras, exposed credentials may let anyone who obtains the URL access live feeds and potentially reuse the credentials elsewhere on the device or networked camera ecosystem.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The server implements logic to identify and forcibly kill an existing local process to take over a lock port. In the context of a camera-control skill, this is unusually powerful host-control behavior and can cause local denial of service or terminate the wrong process if lock metadata, command-line matching, or port ownership checks are inaccurate.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/toolkit/device_mgmt.py (reported line 205)May include surrounding context.

python

if platform.system() == "Windows":
            import re
            import subprocess
            out = subprocess.check_output("getmac", shell=True).decode("gbk", "ignore")
            m = re.search(r"([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}", out)
            if m:
                return m.group(0).replace("-", ":").upper()

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When cloud authorization returns devicePwd, the code immediately persists it locally, without any user-facing notice or consent. That silently converts a temporary cloud-mediated authorization event into long-lived local credential storage, increasing the blast radius if the host or config file is later accessed by another user or process.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes powerful behaviors including package installation, config-file modification, local file access, network discovery of LAN devices, and launching an MCP server, but it does not declare an explicit permission or allowed-tools scope. That creates an over-broad trust boundary where a host agent may permit shell, file, environment, and network actions beyond what a user reasonably expects, increasing the risk of unintended command execution or sensitive local/network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent/user to locate and download a third-party binary (go2rtc) from the internet and place it on the system, but it does not include an explicit safety warning about verifying source authenticity, release integrity, platform match, or execution risk. This can lead to supply-chain compromise or accidental execution of an untrusted binary, especially because the workflow normalizes downloading and running external software to restore functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document states it is an 'English reference' for 'English-speaking users' and directs agent self-healing behavior through this English file, while the Chinese version is framed as manual self-service fallback. This creates a language-policy concern because the skill behavior appears to privilege English by default rather than offering an explicit language choice to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states that camera credentials are persisted to config.yaml, but provides no warning about plaintext secret storage, file permission requirements, backup exposure, or local compromise risk. Since these are camera/admin credentials, disclosure could allow surveillance access, PTZ manipulation, or configuration tampering.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 89)May include surrounding context.

md

**Parameters**:

| Parameter | Type   | Required | Default | Description                                                                                                                                   |
|-----------|--------|:--:|---------|------------------------------------------------------------------------------------------------------------------------------------------------|
| `timeout` | number |    | `15.0`  | Overall time limit (seconds). Returns early once discovery goes quiet: short re-probe rounds, ending after 2 consecutive rounds with no new devices — usually well before the limit |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 147)May include surrounding context.

md

**Returns**: `ConnectResult`

| Field             | Type   | Description                                                                                              |
|------------------|--------|----------------------------------------------------------------------------------------------------------|
| `success`        | bool   | Whether the connection succeeded                                                                        |
| `status`         | string | `"connected"` / `"needs_password"` / `"no_sn"` / `"failed"` / `"auth_rejected"` / `"cloud_pwd_failed"` |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 448)May include surrounding context.

md

**Returns**: `ConnectResult`

| Field             | Type   | Description                                                                                              |
|------------------|--------|----------------------------------------------------------------------------------------------------------|
| `success`        | bool   | Whether the connection succeeded                                                                        |
| `status`         | string | `"connected"` / `"needs_password"` / `"no_sn"` / `"failed"` / `"auth_rejected"` / `"cloud_pwd_failed"` |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 155)May include surrounding context.

md

| `needs_password` | bool   | Whether the user needs to provide a password                                                            |
| `onvif_port`     | int    | Verified ONVIF port (0 = unverified)                                                                    |
| `protocol_type`  | string | Device protocol class `"S"`/`"J"`/`"O"` (empty if unresolved); for O-class, explain the degraded capability set to the user |
| `error_message`  | string | Failure reason                                                                                          |

**status handling**:
- `connected` → connected, ready to operate

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 451)May include surrounding context.

md

| `needs_password` | bool   | Whether the user needs to provide a password                                                            |
| `onvif_port`     | int    | Verified ONVIF port (0 = unverified)                                                                    |
| `protocol_type`  | string | Device protocol class `"S"`/`"J"`/`"O"` (empty if unresolved); for O-class, explain the degraded capability set to the user |
| `error_message`  | string | Failure reason                                                                                          |

**status handling**:
- `connected` → connected, ready to operate

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API explicitly documents that get_audio_video_stream returns an RTSP URL containing credentials. Credential-bearing URLs are highly sensitive because they are commonly exposed via logs, browser history, process lists, screenshots, downstream tool output, and telemetry, enabling unauthorized camera access if leaked.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 450)May include surrounding context.

md

| Field             | Type     | Description                                                                                              |
|------------------|----------|----------------------------------------------------------------------------------------------------------|
| `schema_version` | string   | `"1.0"`                                                                                                  |
| `event_id`       | string   | Unique event ID                                                                                          |
| `event_type`     | string   | Normalized event type: `motion`/`human`/`vehicle`/`tamper`/`region_intrusion`/`line_crossing`/`high_temp`/`low_temp` |
| `camera_id`      | string   | Camera registration name                                                                                 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 453)May include surrounding context.

md

| `schema_version` | string   | `"1.0"`                                                                                                  |
| `event_id`       | string   | Unique event ID                                                                                          |
| `event_type`     | string   | Normalized event type: `motion`/`human`/`vehicle`/`tamper`/`region_intrusion`/`line_crossing`/`high_temp`/`low_temp` |
| `camera_id`      | string   | Camera registration name                                                                                 |
| `camera_name`    | string   | Display name                                                                                             |
| `timestamp`      | string   | ISO 8601 timestamp                                                                                       |
| `severity`       | string   | `"info"` / `"warning"` / `"critical"`                                                                    |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 454)May include surrounding context.

md

| `event_id`       | string   | Unique event ID                                                                                          |
| `event_type`     | string   | Normalized event type: `motion`/`human`/`vehicle`/`tamper`/`region_intrusion`/`line_crossing`/`high_temp`/`low_temp` |
| `camera_id`      | string   | Camera registration name                                                                                 |
| `camera_name`    | string   | Display name                                                                                             |
| `timestamp`      | string   | ISO 8601 timestamp                                                                                       |
| `severity`       | string   | `"info"` / `"warning"` / `"critical"`                                                                    |
| `title`          | string   | Human-readable title                                                                                     |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 455)May include surrounding context.

md

| `event_type`     | string   | Normalized event type: `motion`/`human`/`vehicle`/`tamper`/`region_intrusion`/`line_crossing`/`high_temp`/`low_temp` |
| `camera_id`      | string   | Camera registration name                                                                                 |
| `camera_name`    | string   | Display name                                                                                             |
| `timestamp`      | string   | ISO 8601 timestamp                                                                                       |
| `severity`       | string   | `"info"` / `"warning"` / `"critical"`                                                                    |
| `title`          | string   | Human-readable title                                                                                     |
| `message`        | string   | Human-readable body                                                                                      |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 457)May include surrounding context.

md

| `camera_name`    | string   | Display name                                                                                             |
| `timestamp`      | string   | ISO 8601 timestamp                                                                                       |
| `severity`       | string   | `"info"` / `"warning"` / `"critical"`                                                                    |
| `title`          | string   | Human-readable title                                                                                     |
| `message`        | string   | Human-readable body                                                                                      |
| `label`          | string?  | Target class (e.g. `"person"`, `"car"`); `null` when extraction is unavailable                           |
| `confidence`     | float?   | Confidence; `null` when the protocol does not provide it                                                 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/MCP_TOOLS_API.md (reported line 458)May include surrounding context.

md

| `timestamp`      | string   | ISO 8601 timestamp                                                                                       |
| `severity`       | string   | `"info"` / `"warning"` / `"critical"`                                                                    |
| `title`          | string   | Human-readable title                                                                                     |
| `message`        | string   | Human-readable body                                                                                      |
| `label`          | string?  | Target class (e.g. `"person"`, `"car"`); `null` when extraction is unavailable                           |
| `confidence`     | float?   | Confidence; `null` when the protocol does not provide it                                                 |
| `snapshot_path`  | string   | Linked snapshot path (may be empty within the rate-limit window)                                         |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow documents and instructs disclosure of an RTSP URL containing embedded camera credentials, which exposes secrets in chat transcripts, logs, screenshots, clipboard history, and downstream clients. In a camera-control skill, these credentials can grant continued access to live video and possibly broader device functions, so the documentation materially increases the chance of credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The search_devices() documentation states that discovery will automatically remove registered cameras that are not rediscovered and whose IP no longer responds, but it does not clearly warn the user that invoking discovery is a state-changing, potentially destructive operation. In a camera-management skill, silent deletion of registry entries can cause loss of saved device mappings and credentials, especially during transient network failures or partial outages, leading to unintended disruption and possible re-onboarding with weaker defaults.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation states that search_devices() performs persistent registry updates and prunes entries from config.yaml, which is a meaningful side effect beyond ordinary discovery. In a camera-control skill, discovery is expected to enumerate devices, not silently modify durable state or delete prior registrations; that can surprise callers, cause configuration loss, and widen the blast radius of a simple scan operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.