Security audit

Ezviz Open Camera Config

Security checks across malware telemetry and agentic risk

Overview

This skill performs the camera-configuration actions it advertises, but users should treat its credentials and cached access tokens carefully.

Install only if you want an agent to change Ezviz camera settings. Use dedicated least-privilege Ezviz credentials, prefer environment variables over command-line secrets, disable EZVIZ_TOKEN_CACHE on shared or high-security machines, clear the temp token cache when done, and explicitly review any requested change to arming, recording, masking, or motion-detection settings.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation contains contradictory statements about whether tokens persist across runs, while elsewhere repeatedly describing a cross-run token cache in a temp directory. Inconsistent security documentation is dangerous because users may make deployment decisions under false assumptions and fail to protect or clear persisted credentials appropriately.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The module exposes a standalone CLI that can list cached token metadata, clear caches, and fetch/print token information outside the device-configuration workflow. In an agent skill context, this broadens the attack surface and enables credential-management actions that are not strictly necessary for the stated purpose, increasing the chance of misuse or accidental disclosure.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Printing even a partial live access token to stdout leaks credential material into terminal history, logs, orchestration traces, or agent output streams. Partial tokens can still aid correlation, troubleshooting misuse, or combined attacks, and there is no operational need to expose token contents to users.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script silently falls back to reading app credentials from local OpenClaw config files, which contradicts the stated requirement that EZVIZ_APP_KEY and EZVIZ_APP_SECRET must be supplied via environment variables. This broadens the credential sources beyond the documented trust boundary and can cause the skill to use unintended or over-privileged credentials from a user's home directory without explicit operator awareness.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The main routine accepts app_key and app_secret from command-line arguments if environment variables are absent, directly violating the manifest's requirement to require environment variables. Command-line secrets are commonly exposed via shell history, process listings, job logs, and orchestration telemetry, increasing the chance of credential leakage and unauthorized device control.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code persists live access tokens in a predictable file under the system temporary directory, which is a higher-risk location for sensitive credentials because temp storage is often shared, inspected, or cleaned unpredictably. Although the file is chmodded to 0600 after writing, the design still increases exposure of reusable credentials at rest and may be unsafe on multi-user or loosely isolated systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.