Security audit

Dahua Cloud Open Device Image Analysis

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: captures authorized Dahua camera snapshots, saves them locally, and sends them to Dahua Cloud for AI analysis, but it handles sensitive credentials and surveillance images.

Install only if you are authorized to capture images from the target Dahua devices and are comfortable sending those images to Dahua Cloud for analysis. Use least-privilege Dahua credentials, do not print or share AK/SK values, avoid the echo-based troubleshooting examples on shared or logged terminals, and regularly delete captured_images files that are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The FAQ tells users to print credential-bearing environment variables directly to the terminal, including AK and SK, without any warning that these values are secrets. This can expose credentials through screen sharing, terminal history, logging, or support screenshots, which is especially risky in an IoT/cloud integration where the keys may grant API access to device data or control functions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This section explicitly recommends listing all DAHUA-related environment variables and printing the product ID, AK, and SK, again without caution about secret exposure. In the context of a cloud-connected image-analysis skill, these credentials likely enable access to cloud APIs and device resources, so disclosure could lead to unauthorized use, data exposure, or service abuse.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README explicitly says captured images are automatically saved locally and analyzed by a cloud AI service, but it does not clearly warn about privacy, consent, retention, or legal/compliance implications for people appearing in surveillance footage. In an IoT camera/surveillance context, this omission increases the risk of misuse, unauthorized monitoring, and improper handling of personal data.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill captures surveillance images, saves them locally, and sends them to a cloud AI analysis endpoint, but the documentation does not clearly warn users about privacy, retention, consent, and third-party data transfer implications. In a monitoring/safety context, this can expose sensitive images of people, vehicles, workplaces, or incidents without informed operator awareness, increasing privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill downloads camera snapshots and stores them on local disk under a predictable directory without any retention controls, permission hardening, encryption, or explicit user consent. Because these images may contain people, vehicles, or sensitive site details, unintended persistence increases privacy and data exposure risk on shared or multi-user systems.

Missing User Warnings

Medium

Confidence: 73% confidence
Finding: The workflow sends a captured image URL and free-form prompt to external Dahua cloud APIs for analysis, which can expose surveillance-derived data to a third-party service without any explicit privacy notice or operator acknowledgment. In this skill's context, the data may come from security cameras, making the privacy implications more serious than a typical consumer image upload.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.