T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:33- Finding
Shell Command Injection Through User-Controlled Stream URLs and Conditions
- Content
View full analysis
- Remediation
View remediation
Security audit
Trio Stream Vision
Security checks for vulnerabilities and agentic risk
Overview
This is a real video-analysis skill, but it needs Review because it can send camera feeds to an external service, run ongoing monitoring, and uses unsafe shell examples for user-supplied text.
Before installing, confirm you are comfortable sending stream URLs and captured frames or clips to Trio for processing, use only streams you own or are authorized to analyze, avoid camera URLs with embedded credentials, prefer a verified ClawHub or pinned release over direct mutable git clones, store the API key in a secret store where possible, and require explicit confirmation before starting monitoring, digest, or webhook delivery.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:25- Finding
Unpinned and Inconsistent Direct Git Installation Sources
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (30)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md |-------|-----| | Agent doesn't validate stream first | Add stronger "ALWAYS validate first" language in Rules section | | Agent forgets to show explanation | Emphasize in Rules: "ALWAYS show the explanation field" | | Agent starts monitor without warning about cost | Add cost disclosure to the monitor workflow | | Condition writing is poor | The "Condition Writing Tips" section helps the agent write better conditions | | Error messages are confusing | The `remediation` field from the API gives actionable guidance |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Ask a yes/no question about what's currently visible on a stream. Costs 1 credit ($0.01).
bash curl -s -X POST "https://trio.machinefi.com/api/check-once" \ -H "Authorization: Bearer $TRIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Monitor a stream continuously and get alerted when a condition becomes true. Costs 2 credits/min ($0.02/min).
bash curl -s -X POST "https://trio.machinefi.com/api/live-monitor" \ -H "Authorization: Bearer $TRIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Get narrative summaries of what's happening on a stream at regular intervals. Costs 2 credits/min ($0.02/min).
bash curl -s -X POST "https://trio.machinefi.com/api/live-digest" \ -H "Authorization: Bearer $TRIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
4. Check Job Status
bash curl -s "https://trio.machinefi.com/api/jobs/JOB_ID_HERE" \ -H "Authorization: Bearer $TRIO_API_KEY" | python3 -m json.tool
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
5. List All Jobs
bash curl -s "https://trio.machinefi.com/api/jobs?limit=20&offset=0" \ -H "Authorization: Bearer $TRIO_API_KEY" | python3 -m json.tool
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
6. Cancel a Job
bash curl -s -X DELETE "https://trio.machinefi.com/api/jobs/JOB_ID_HERE" \ -H "Authorization: Bearer $TRIO_API_KEY" | python3 -m json.tool
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `NOT_LIVESTREAM` — URL is not a live stream. Confirm it's actively broadcasting. - `STREAM_FETCH_FAILED` — Cannot reach the stream. Check URL and network. - `STREAM_OFFLINE` — Stream exists but is offline. Wait for it to go live. - `MAX_JOBS_REACHED` — Too many concurrent jobs. Cancel old ones with DELETE /jobs/{id}. If you get an error, always show the `remediation` field to the user — it contains actionable guidance.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The marketing copy promotes live camera monitoring, person/package detection, and smart alerts without any notice about privacy, consent, or the fact that video may be continuously transmitted to an external AI service. That omission can lead users to deploy the skill in surveillance-sensitive contexts without understanding legal, ethical, or data-handling risks, increasing the chance of non-consensual monitoring of people or private property.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup and usage documentation instructs users to enable continuous monitoring and alerting for live streams but does not warn about privacy obligations, consent requirements, or ongoing transmission of video to a third-party service. In this skill's context, the omission is more dangerous because the capability is explicitly designed for surveillance-style monitoring of homes, doors, and other real-world spaces, which raises legal and privacy risks for bystanders and occupants.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document explicitly reframes the skill as an 'AI security guard' and promotes 24-hour monitoring of live cameras, which broadens the use case from generic stream understanding into persistent surveillance and security monitoring. That increases the likelihood of deployment for monitoring people in public or semi-private spaces without guardrails, policy limits, or abuse-prevention language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The markdown encourages broad live-camera monitoring and presents surveillance as cheap, scalable, and labor-replacing, but omits any privacy, consent, or misuse warnings. In context, this makes the skill more dangerous because it normalizes using AI to watch public camera feeds for security purposes without discussing legal or ethical constraints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The recommended skill description emphasizes convenience and broad camera/stream support but omits a prominent upfront disclosure that live camera frames are sent to Trio's cloud services for analysis. Users may connect indoor, private, or workplace cameras without realizing third-party transmission is involved, creating privacy, consent, and compliance risks that are especially relevant for surveillance-oriented use cases.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The public demo plan encourages connecting live streams and exposing a shareable interface without any requirement to verify that streams are public, authorized, or consented. In a vision-monitoring skill, this can lead to unauthorized surveillance, disclosure of sensitive scenes, and downstream privacy harm if users analyze or share feeds containing people, homes, or other private spaces.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The meta-skill is designed to let other agents invoke a free camera check and surface results, but it omits any privacy notice, consent requirement, or restriction on what streams may be analyzed. Because this broadens access and automates invocation across agents, it increases the chance of unauthorized analysis or disclosure of sensitive visual information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An always-on agent that posts observations from camera feeds to social media creates a direct pipeline from surveillance to public disclosure. Without privacy screening, consent checks, and content restrictions, it could publish identifying details, behavioral patterns, locations, or other sensitive observations about individuals captured on streams, amplifying harm beyond the original feed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide promotes analysis of livestreams and local images through an external vision API but does not consistently warn that potentially sensitive visual data and stream metadata may leave the local environment. In a surveillance/video-analysis skill, this omission materially increases privacy, compliance, and user-consent risk because users may submit camera feeds containing people, homes, workplaces, or other regulated content.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The guide advises persisting the API key in shell configuration files, which can increase long-term secret exposure through backups, dotfile sync, shared accounts, terminal history mistakes, or accidental publication. In a skill that relies on paid third-party API access, compromised credentials can lead to unauthorized usage, billing loss, and access to associated account resources.
- Content
md 1. Go to https://console.machinefi.com 2. Sign up (free, gives you 100 credits / $1.00) 3. Navigate to the API Keys section 4. Create and copy your API key ### 2b. Set the Environment Variable
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Option 1: User-level skills directory mkdir -p ~/.openclaw/skills/trio-vision cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md # Option 2: Project-level skills directory (higher precedence) mkdir -p ./skills/trio-vision
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Option 1: User-level skills directory mkdir -p ~/.openclaw/skills/trio-vision cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md # Option 2: Project-level skills directory (higher precedence) mkdir -p ./skills/trio-vision
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Option 1: User-level skills directory mkdir -p ~/.openclaw/skills/trio-vision cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md # Option 2: Project-level skills directory (higher precedence) mkdir -p ./skills/trio-vision
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Option 1: User-level skills directory mkdir -p ~/.openclaw/skills/trio-vision cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md # Option 2: Project-level skills directory (higher precedence) mkdir -p ./skills/trio-vision
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation example encourages broad natural-language triggering using ordinary chat phrasing, which can cause the skill to activate when a user did not explicitly intend to invoke an external video-analysis workflow. In this skill's context, accidental activation can lead to unintended transmission of stream URLs and possibly sensitive video content to a third-party API, as well as unexpected cost-incurring operations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
6a. GitHub Repository
Create a public GitHub repo for the skill:
bash cd trio-vision-skill
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README encourages users to analyze livestreams, RTSP camera feeds, and security cameras through a third-party vision API, but it does not clearly warn that stream content may be transmitted off-device for processing. This creates a real privacy and compliance risk because users may submit personal, bystander, or security-sensitive footage without informed consent or understanding of retention, sharing, or jurisdictional implications.
- Content