Trio Vision

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:40 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent camera-monitoring purpose, but it under-discloses sensitive live-video processing and uses unsafe shell command templates for user-provided stream data.

Install only if you are comfortable sending selected live camera streams, frames, summaries, and webhook notifications to Trio/MachineFi and any configured webhook destination. Use only feeds you are authorized to monitor, avoid sensitive indoor or regulated environments unless you have consent, store the API key in a secret manager rather than a shell profile, and prefer a structured HTTP client or JSON-safe command construction instead of pasting untrusted values into the provided curl snippets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34

Finding

Shell Command Injection Through Unescaped User-Controlled JSON Values

Content

View full analysis

Remediation

View remediation

"$payload_file" curl --fail-with-body --silent --show-error \ -X POST "https://trio.machinefi.com/api/check-once" \ -H "Authorization: Bearer $TRIO_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "@$payload_file" ``` 4. Pass values through environment variables or fixed argument arrays rather than generating a shell program dynamically. 5. Validate stream URLs against explicitly supported schemes. Reject shell metacharacters only as defense in depth; validation must not replace correct argument handling. 6. Apply the same correction to the check-once, live-monitor, and live-digest examples. 7. Run the agent with a restricted operating-system account, a minimal environment, limited filesystem access, and constrained outbound network access to reduce impact if another injection flaw is introduced. 8. Add automated tests using quotes, newlines, command substitutions, semicolons, and other shell metacharacters to verify that inputs remain data rather than executable syntax. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: IMPLEMENTATION_GUIDE.md:41

Finding

Long-Lived API Key Stored in a Plaintext Shell Startup File

Content

View full analysis

> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The implementation guide recommends writing a long-lived Trio API key directly into `~/.zshrc`. Shell startup files are plaintext and are commonly copied into backups, diagnostic archives, dotfile repositories, and workstation migration bundles. They may also be readable by local software operating under the same user account. Sourcing the file exports the key into the environment of the current shell. Subsequent child processes inherit that environment unless it is explicitly removed. This broadens credential exposure beyond the Skill process and violates least-privilege secret handling. Some systems protect home-directory files from other operating-system users, so exposure is environment-dependent. Nevertheless, plaintext profile persistence is unnecessary because the implementation guide itself identifies OpenClaw configuration as an alternative credential-storage mechanism. ### Attack Path 1. A user follows the implementation guide and places the real API key in `~/.zshrc`. 2. The credential remains stored in plaintext across sessions. 3. The profile is read by a same-user process, copied into a dotfile repository, included in a backup or support archive, or otherwise disclosed. 4. An attacker extracts the API key from the exposed file. 5. The attacker authenticates to the Trio API using the stolen bearer credential. 6. The attacker can consume the victim's API credits and perform operations permitted to that key until it is revoked or rotated. ### Impact Assessment The immediate impact is compromise of the Trio AP ...[truncated 580 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · IMPLEMENTATION_GUIDE.md (reported line 117)May include surrounding context.

md

|-------|-----|
| Agent doesn't validate stream first | Add stronger "ALWAYS validate first" language in Rules section |
| Agent forgets to show explanation | Emphasize in Rules: "ALWAYS show the explanation field" |
| Agent starts monitor without warning about cost | Add cost disclosure to the monitor workflow |
| Condition writing is poor | The "Condition Writing Tips" section helps the agent write better conditions |
| Error messages are confusing | The `remediation` field from the API gives actionable guidance |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Ask a yes/no question about what's currently visible on a stream. Costs 1 credit ($0.01).

bash

curl -s -X POST "https://trio.machinefi.com/api/check-once" \
  -H "Authorization: Bearer $TRIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Monitor a stream continuously and get alerted when a condition becomes true. Costs 2 credits/min ($0.02/min).

bash

curl -s -X POST "https://trio.machinefi.com/api/live-monitor" \
  -H "Authorization: Bearer $TRIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Get narrative summaries of what's happening on a stream at regular intervals. Costs 2 credits/min ($0.02/min).

bash

curl -s -X POST "https://trio.machinefi.com/api/live-digest" \
  -H "Authorization: Bearer $TRIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

4. Check Job Status

bash

curl -s "https://trio.machinefi.com/api/jobs/JOB_ID_HERE" \
  -H "Authorization: Bearer $TRIO_API_KEY" | python3 -m json.tool

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

5. List All Jobs

bash

curl -s "https://trio.machinefi.com/api/jobs?limit=20&offset=0" \
  -H "Authorization: Bearer $TRIO_API_KEY" | python3 -m json.tool

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

6. Cancel a Job

bash

curl -s -X DELETE "https://trio.machinefi.com/api/jobs/JOB_ID_HERE" \
  -H "Authorization: Bearer $TRIO_API_KEY" | python3 -m json.tool

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

- `NOT_LIVESTREAM` — URL is not a live stream. Confirm it's actively broadcasting.
- `STREAM_FETCH_FAILED` — Cannot reach the stream. Check URL and network.
- `STREAM_OFFLINE` — Stream exists but is offline. Wait for it to go live.
- `MAX_JOBS_REACHED` — Too many concurrent jobs. Cancel old ones with DELETE /jobs/{id}.

If you get an error, always show the `remediation` field to the user — it contains actionable guidance.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly states that frames are sent to Trio's servers and then to a vision model, but the recommended public description omits this privacy-critical disclosure. For a skill handling live security cameras, baby monitors, home interiors, and workplace streams, failing to warn users about cloud transmission can lead to uninformed consent, exposure of sensitive footage, and regulatory or policy issues around third-party data processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The recommended description uses broad, natural-language phrasing like 'turn any live camera into a smart camera' and 'ask questions about any live stream,' which can cause an agent framework to invoke the skill for vague everyday requests without clear scope boundaries. In a camera-monitoring skill, over-broad activation increases the chance of unintended access to surveillance feeds or accidental processing of sensitive visual data when the user did not explicitly intend to use this capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document promotes analysis of live video streams, security cameras, and monitoring workflows without an explicit privacy, consent, and lawful-use warning. In this context, the omission increases the risk of the skill being used to surveil people or process camera feeds without adequate notice, authorization, or user understanding.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The guide instructs users to persist the API key in shell startup files such as ~/.zshrc. Persisting secrets in broadly reused shell profiles increases the chance of accidental disclosure through dotfile sync, backups, screenshots, support bundles, or later shell-command leakage from other tools.

Content

Scanner excerpt · IMPLEMENTATION_GUIDE.md (reported line 36)May include surrounding context.

md

1. Go to https://console.machinefi.com
2. Sign up (free, gives you 100 credits / $1.00)
3. Navigate to the API Keys section
4. Create and copy your API key

### 2b. Set the Environment Variable

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · IMPLEMENTATION_GUIDE.md (reported line 57)May include surrounding context.

bash

# Option 1: User-level skills directory
mkdir -p ~/.openclaw/skills/trio-vision
cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md

# Option 2: Project-level skills directory (higher precedence)
mkdir -p ./skills/trio-vision

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · IMPLEMENTATION_GUIDE.md (reported line 61)May include surrounding context.

bash

# Option 1: User-level skills directory
mkdir -p ~/.openclaw/skills/trio-vision
cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md

# Option 2: Project-level skills directory (higher precedence)
mkdir -p ./skills/trio-vision

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · IMPLEMENTATION_GUIDE.md (reported line 475)May include surrounding context.

bash

# Option 1: User-level skills directory
mkdir -p ~/.openclaw/skills/trio-vision
cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md

# Option 2: Project-level skills directory (higher precedence)
mkdir -p ./skills/trio-vision

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · IMPLEMENTATION_GUIDE.md (reported line 476)May include surrounding context.

bash

# Option 1: User-level skills directory
mkdir -p ~/.openclaw/skills/trio-vision
cp trio-vision-skill/SKILL.md ~/.openclaw/skills/trio-vision/SKILL.md

# Option 2: Project-level skills directory (higher precedence)
mkdir -p ./skills/trio-vision

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide recommends very broad natural-language invocation examples like asking generally 'What's happening on this YouTube live stream?'. In agent systems, overly broad trigger phrasing can cause accidental invocation during ordinary conversation, which may lead to unintended external API calls, stream analysis, and surprise cost or privacy impact.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · IMPLEMENTATION_GUIDE.md (reported line 207)May include surrounding context.

6a. GitHub Repository

Create a public GitHub repo for the skill:

bash

cd trio-vision-skill

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README says users can 'Ask your cameras questions in plain English' but does not define specific trigger phrases, scope limits, or exclusion conditions. This creates ambiguity about when the skill should activate versus when a general conversational request about cameras should not invoke it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes continuous monitoring of live cameras and delivery of alerts to chat platforms, but does not warn users that video frames and metadata may be transmitted to a third-party API and messaging services. In a surveillance-oriented skill, missing privacy and data-handling disclosures materially increase the risk of accidental exposure of sensitive household, workplace, or bystander information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill repeatedly instructs users to send live camera streams, security camera feeds, and RTSP sources to a third-party API, but it does not clearly warn that potentially sensitive visual data will leave the local environment and be processed externally. In a surveillance-oriented skill, omission of explicit privacy and consent guidance increases the risk of exposing private spaces, bystanders, or regulated data without informed approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This endpoint use transmits a user-provided stream URL and condition to an external third-party service for analysis. While expected for the product's function, it is still a genuine external data transfer that can expose private camera content if users are not adequately informed or if the stream contains sensitive scenes.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Ask a yes/no question about what's currently visible on a stream. Costs 1 credit ($0.01).

bash

curl -s -X POST "https://trio.machinefi.com/api/check-once" \
  -H "Authorization: Bearer $TRIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill offers include_frame/base64 image return options without warning that captured frames may contain sensitive visual information such as faces, interiors, documents, or screens. Returning image data to chat logs, clients, or downstream tooling increases the chance of accidental retention and secondary disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Continuous monitoring sends recurring stream data to the external API over time, increasing both the amount and sensitivity of transmitted content compared with a one-time snapshot. Persistent third-party access to live feeds amplifies privacy risk, especially for home or workplace cameras.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Monitor a stream continuously and get alerted when a condition becomes true. Costs 2 credits/min ($0.02/min).

bash

curl -s -X POST "https://trio.machinefi.com/api/live-monitor" \
  -H "Authorization: Bearer $TRIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The webhook feature documents automatic POST delivery to an arbitrary user-supplied endpoint but does not warn that trigger events, summaries, or related metadata may be forwarded outside the original system boundary. This can lead to unintended disclosure if the webhook target is misconfigured, third-party hosted, or controlled by an attacker.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: IMPLEMENTATION_GUIDE.md:324