ClawHub
Back to skill

Security audit

Window Truth

Security checks for vulnerabilities and agentic risk

Overview

This weather-camera skill appears purpose-aligned, but it deserves review because it uses IP camera video and audio, sends location to a weather API, and stores local observation logs with limited controls.

Install only if you are comfortable giving the skill access to an IP camera stream that may include audio, and configure your own RTSP URL and coordinates deliberately. Rotate or avoid embedded camera credentials, review the local data/twilight_predictions.jsonl log, and run it in a constrained environment if the camera or location is sensitive.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tainted flow: 'cmd' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"-i", RTSP_URL,
        "-frames:v", "1", "-f", "image2", "-"
    ]
    result = subprocess.run(cmd, capture_output=True)
    return result.stdout

def capture_audio(duration=3):
Confidence
88% confidence
Finding
The command includes executable/configuration values taken from environment variables, especially FFMPEG and RTSP_URL, and then executes them without validation. If an attacker can influence the environment, they can replace the ffmpeg binary path with an arbitrary program or point ffmpeg at attacker-controlled RTSP content, turning a camera utility into a code-execution or unsafe-parser exposure path.

Tainted flow: 'cmd' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"-t", str(duration), "-f", "wav", "-acodec", "pcm_s16le",
        "-ar", "8000", "-ac", "1", "-"
    ]
    result = subprocess.run(cmd, capture_output=True)
    return result.stdout

def calculate_brightness(jpeg_bytes):
Confidence
88% confidence
Finding
This second ffmpeg execution has the same trust-boundary issue: attacker-influenced environment values are used to launch an external parser on untrusted network media. Media parsers like ffmpeg have a long history of memory-safety bugs, so feeding attacker-controlled streams increases the danger beyond a normal subprocess call.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises operational capabilities that imply environment access, file writing, networking, and shell execution, but it declares no permissions. That creates a trust and review gap: a host may invoke the skill without understanding it can reach RTSP streams, call external APIs, invoke ffmpeg, and persist local data. In an agent ecosystem, undeclared capabilities are dangerous because they bypass least-privilege review and can enable unexpected data access or command execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented purpose is narrowly framed as local camera-based rain truthing, but the behavior also includes RTSP audio capture, broader conflict detection, and local observation logging. This mismatch is security-relevant because users may consent to a simple weather-check skill without realizing it can record ambient sound and store detailed local telemetry. Audio capture from an IP camera especially increases privacy risk beyond the stated use case.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The script persistently logs timestamps, inferred local conditions, and app-comparison results to disk without any retention, access-control, or disclosure safeguards. In context, this creates a behavioral and location-linked dataset that may expose occupancy patterns or surveillance-derived observations if the host is shared or compromised.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill is framed as camera/window weather observation, but it also captures and analyzes audio from the RTSP stream. That materially changes the privacy profile by enabling microphone-based environmental monitoring or incidental eavesdropping, especially because users may not expect audio collection from a 'window truth' weather tool.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The default RTSP URL embeds static camera credentials directly in configuration, which encourages insecure secret handling and raises the chance of credential leakage via source control, process environment dumps, logs, or screenshots. Because these are surveillance-device credentials, compromise can expose live camera and audio access.

Missing User Warnings

Low
Confidence
72% confidence
Finding
This is primarily a privacy issue rather than a technical exploit: the script transmits precise location coordinates to a third-party weather service without user-facing notice. In a home-observation skill, location can be sensitive because it ties collected camera/audio-derived observations to a specific place.

Static analysis

No suspicious patterns detected.