Dahua Cloud Open Device Image Analysis

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:44 AM UTC
• Version: 1.0.5

Overview

The skill appears to perform its stated Dahua camera snapshot and AI analysis function, but it handles surveillance images and cloud credentials with several under-scoped safety issues users should review before installing.

Review before installing. Use this only for cameras and scenes you are authorized to capture and send to Dahua Cloud. Use least-privilege Dahua credentials, do not print or share DAHUA_CLOUD_SK, rotate the key if it was exposed in logs or screenshots, and avoid persistent plaintext shell startup storage. Run the skill from a restricted working directory or dedicated account, treat captured_images as sensitive, and prefer fixes that validate device IDs, restrict downloaded URLs, reduce logging, add retention controls, and pin dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: device_image_analysis.py:272

Finding

Path Traversal Through Unvalidated Device Identifier

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: device_image_analysis.py:229

Finding

Server-Side Request Forgery Through Unvalidated Snapshot URL

Content

View full analysis

Remediation

View remediation

MAX_IMAGE_BYTES: raise ValueError("Image exceeds size limit") output.write(chunk) ``` 6. Validate the `Content-Type` and inspect the file signature before retaining the response. 7. Apply outbound firewall rules so the process can reach only required Dahua and approved storage services. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: device_image_analysis.py:418

Finding

Sensitive Snapshot URLs, Prompts, and Analysis Results Exposed in Logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:192

Finding

Documentation Instructs Users to Print the Dahua Secret Key

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Dependency Version Prevents Reproducible Installation

Content

View full analysis

=2.31.0 ``` The same open-ended requirement is documented in `README.md:319` and `SKILL.md:410`. ### Technical Analysis The lower-bound-only version constraint allows installation of any future `requests` release. No lock file or package hashes are provided. Consequently, separate installations can resolve to different dependency versions, and future incompatible or compromised releases would satisfy the declared requirement automatically. The package name is the canonical `requests` package, and the reviewed project does not specify an unknown package index or demonstrate typosquatting. This is therefore a reproducibility and supply-chain hardening issue rather than evidence that the current dependency is malicious. ### Attack Path 1. A user installs the dependencies at a later date. 2. The package resolver selects a newer release satisfying `requests>=2.31.0`. 3. If that release or one of its transitive dependencies is compromised or unexpectedly incompatible, it is installed without project-level review. 4. Installed dependency code executes when imported or used by the Skill. This path is conditional on a future compromised or defective release; no such release was established during this static audit. ### Impact Assessment A compromised dependency executes with the same filesystem, environment, and network privileges as the Skill process. That context includes access to Dahua credentials stored in environment variables and camera-analysis data. The present finding does not show that the currently available canonical package is compromised. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (16)

Tainted flow: 'headers_img' from os.environ.get (line 211, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · device_image_analysis.py (reported line 420)May include surrounding context.

python

# Print request info
        print(f'  Request Payload: {json.dumps(payload_img, ensure_ascii=False)}')
        
        response = requests.post(
            f'{base_url.rstrip("/")}{API_AI_ANALYSIS}',
            headers=headers_img,
            json=payload_img,

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 92% confidence

Finding

The README instructs users to append cloud credentials directly into ~/.bashrc, creating long-lived plaintext secret persistence on disk and automatic loading into future shells. In the context of a skill that accesses surveillance-device imagery and cloud APIs, credential compromise could enable unauthorized device access, image capture, or downstream cloud API abuse.

Content

Scanner excerpt · README.md (reported line 182)May include surrounding context.

安全警告*: 将凭证写入 ~/.bashrc 会将敏感信息以明文形式持久化存储在磁盘上。建议：

• 优先使用临时环境变量（方式 3）进行测试
• 如需永久设置，确保 ~/.bashrc 文件权限为 600 (chmod 600 ~/.bashrc)
• 定期轮换凭证
• 不要在共享系统或多用户环境中使用此方法

添加到启动文件：

bash

echo "export DAHUA_CLOUD_PRODUCT_ID='你的 AppID'" >> ~/.bashrc
echo "export DAHUA_CLOUD_AK='你的 AccessKey'" >> ~/.bashrc
echo "export DAHUA_CLOUD_SK='你的 SecretKey'" >> ~/.bashrc
source ~/.bashrc

验证是否生效:

bash

echo $DAHUA_CLOUD_PRODUCT_ID
echo $DAHUA_CLOUD_AK
echo $DAHUA_CLOUD_SK

---

工作流程

text

┌─────────────┐
│ 1. 获取 Cloud Token │
│   (AppAccessToken)  │
└──────┬──────┘
       ▼
┌─────────────┐
│ 2. 设备抓图

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · device_image_analysis.py (reported line 186)May include surrounding context.

python

current_time = int(time.time())
        if not self.access_token or current_time > self.token_expiry:
            if not self.get_app_access_token():
                return {'success': False, 'message': 'Failed to get access token'}
        
        step_label = "[Step 2-Retry]" if is_retry else "\n[Step 2]"
        print(f"{step_label} Capturing snapshot")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The FAQ tells users to print credential-bearing environment variables, including the secret key, directly to the terminal. While this is framed as troubleshooting, it can expose secrets to shoulder surfing, screen recording, terminal logging, CI logs, or support screenshots, making credential compromise more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section explicitly recommends listing all Dahua-related environment variables and printing AK/SK values during testing. In the context of an IoT/cloud integration skill, these credentials likely grant access to cloud APIs or device data, so exposing them during diagnostics can lead to unauthorized access if terminals, logs, or shared sessions are observed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly describes capturing images from IoT surveillance devices and sending them to a cloud AI analysis API, but it does not clearly warn users about privacy, consent, data handling, retention, or cross-boundary transfer risks. In a surveillance/image-analysis skill, this omission is materially important because users may process personal or sensitive visual data without understanding legal or organizational obligations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 175)May include surrounding context.

md

> ⚠️ **安全警告**: 将凭证写入 `~/.bashrc` 会将敏感信息以明文形式持久化存储在磁盘上。建议：
> - 优先使用临时环境变量（方式 3）进行测试
> - 如需永久设置，确保 `~/.bashrc` 文件权限为 600 (`chmod 600 ~/.bashrc`)
> - 定期轮换凭证
> - 不要在共享系统或多用户环境中使用此方法

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents and requires sensitive environment variables and clearly performs outbound network operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a capability transparency gap: an agent or user may invoke the skill without understanding that it can access secrets and send data externally, increasing the risk of unintended credential use or exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description, setup steps, examples, and operational guidance are presented only in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should either be optional for the user or clearly documented as a justified locale-specific limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill sends the captured image URL and user prompt to Dahua cloud AI services without an explicit privacy warning or consent flow. In the context of monitoring images, that can expose sensitive visual data and operational details to third-party processing in a way users may not expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill saves surveillance snapshots to local disk under captured_images/<device_id>/ without any retention controls, encryption, or explicit disclosure in the described behavior. These images may contain sensitive physical-security or personal data, so local persistence increases exposure through later unauthorized access, backup propagation, or accidental sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code writes captured camera images to disk without warning the user beforehand. Because the skill handles surveillance imagery, silent persistence can violate user expectations, internal policy, or privacy requirements, and increases the chance that sensitive images remain accessible after the analysis task is complete.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Nearly all user-facing instructions, prompts, examples, and returned-content examples are presented only in Chinese, which effectively imposes a language requirement. The document does not state that the skill is China-region-specific or offer users an English or selectable language option.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes recognizable scenarios such as people, vehicles, helmets, masks, smoke, fire, falls, and intrusion detection. The implementation simply forwards any user-supplied prompt to the cloud AI imageAnalysis endpoint, making the skill behavior more open-ended than the advertised task-specific analysis scope.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any newer release to be installed without ensuring reproducibility or review. In a security-sensitive skill that interacts with IoT devices and cloud services, this can lead to unexpected upgrades, supply-chain risk, or accidental inclusion of vulnerable/breaking versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Because requests is not pinned, it is impossible to verify from this manifest whether deployment will use a version affected by known advisories. Given this skill processes images from IoT/security devices and may communicate with remote services, using an indeterminate version of a library with multiple historical CVEs increases supply-chain uncertainty and could expose credentials, network traffic, or service behavior if a vulnerable release is resolved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.