ClawHub
Back to skill

Security audit

raspberry-pi-camera-service

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Raspberry Pi camera service, but it exposes a persistent unauthenticated network camera and media API with broad system installation behavior.

Install only on a Raspberry Pi you administer and only on a trusted network. Before enabling it, bind the service to localhost or firewall it, add authentication or other access controls, avoid running it as root, protect or remove remote download/delete endpoints, and review the sudo installer and global pip installation behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documents capabilities that imply local environment inspection, HTTP/network service interaction, and deployment via Python commands, but it does not declare corresponding permissions. This creates a transparency and policy gap: an agent may invoke camera-related and service-deployment behavior without users or platform controls clearly understanding the required access level.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The skill exposes a file deletion capability that is broader than its declared photo/video/GIF capture purpose. In an agent context, this creates an unexpected destructive action surface: a caller that can trigger capture flows may also be able to delete locally created evidence or user data without explicit user understanding.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The installer performs an extra privileged action outside the stated purpose of deploying the camera service: it builds and installs a global Python package into the system interpreter. Because the script must run as root, this modifies host-wide Python state and expands the trust boundary beyond the service itself, increasing supply-chain and maintenance risk.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill advertises camera capture/recording features, but also exposes unauthenticated file enumeration, download, and deletion operations over the entire output directory. This expands the remotely reachable attack surface beyond the stated purpose and allows any caller who can reach the service to browse and retrieve previously captured media, which is a confidentiality issue for camera-derived data.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The service provides a remote endpoint that deletes files from the media output directory without any authentication or ownership checks. An attacker who can access the HTTP service can erase recorded evidence or user content, causing integrity and availability loss that is unrelated to the core capture function.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger description is very broad, covering common situations like needing a photo or observing progress, which can overlap with ordinary conversation. In a camera skill, accidental invocation is more sensitive than usual because it may activate image capture or recording of the physical environment without sufficiently explicit intent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly supports taking photos, recording video/GIFs, listing/downloading/deleting video files, and operating a physical camera, but the documentation does not warn about privacy, consent, retention, or handling of captured media. Because this skill interacts with real-world visual data, missing privacy disclosures materially increases the risk of covert capture, over-collection, and unsafe file handling.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code captures images and videos directly to local storage without any built-in confirmation, notice, or consent mechanism. In a camera-control skill, silent recording and photo creation are privacy-sensitive actions; in an agent setting this is more dangerous because the capability can be triggered remotely or implicitly by higher-level workflows.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Using pip with --break-system-packages as root forces modification of the system-managed Python environment, bypassing distro protections intended to prevent breakage and package shadowing. This can destabilize the host, create hard-to-audit global code execution paths, and silently affect other Python applications.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1. 开始录制
curl -X POST http://raspberry-pi:27793/start \
  -H "Content-Type: application/json" \
  -d '{
    "task_name": "http_test",
Confidence
77% confidence
Finding
curl -X POST http://raspberry-pi:27793/start \ -H "Content-Type: application/json" \ -d '{ "task_name": "http_test", "output_format": "gif", "heartbeat_timeout": 30 }' # 假设返回: # { #

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `POST /stop/{session_id}`：停止录制并转换
- `PUT /heartbeat/{session_id}`：发送心跳续期会话
- `GET /videos/{filename}`：下载视频文件
- `DELETE /videos/{filename}`：删除视频文件
- `GET /videos/`：列出所有视频文件

#### 请求/响应模型
Confidence
82% confidence
Finding
DELETE /videos/{filename}`：删除视频文件

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.