Ezviz Open PTZ Control

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:46 AM UTC
• Version: 1.0.2

Overview

This camera-control skill mostly does what it says, but it should be reviewed because it handles Ezviz credentials and tokens less safely than its documentation claims.

Install only if you are comfortable giving the skill Ezviz device-control authority. Use a dedicated low-permission Ezviz application, avoid passing AppSecret on the command line, assume tokens may be written to the shared temp cache even when caching is documented as disabled, and avoid shared machines unless the cache implementation is fixed or the token is cleaned up securely afterward.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: lib/token_manager.py:130

Finding

Disabling Token Caching Does Not Prevent Token Persistence

Content

View full analysis

Remediation

View remediation

8 else app_key } save_token_cache(all_cache) ``` 2. When caching is disabled, avoid creating the cache directory or reading any pre-existing cache. 3. Clearly distinguish between “do not read cache” and “do not persist token” if both behaviors must be supported. 4. Add automated tests confirming that `EZVIZ_TOKEN_CACHE=0` creates neither a cache directory nor a cache file. 5. Consider deleting an existing entry for the relevant account when the user explicitly disables persistence, subject to clear documentation and user consent. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:27

Finding

Documented Environment-Variable Authentication Is Ignored

Content

View full analysis

[params...]") print("\nCommands:") print(" list - List all devices") print(" status - Get device status") print(" capacity - Get device capacity") print(" ptz_start - Start PTZ control") print(" ptz_stop - Stop PTZ control") print(" preset_add - Add preset") print(" preset_move - Move to preset") print(" preset_clear - Clear preset") print(" mirror - Mirror flip") sys.exit(1) # Parse arguments app_key = sys.argv[1] app_secret = sys.argv[2] command = sys.argv[3] args = sys.argv[4:] ``` ### Technical Analysis The script reads `EZVIZ_APP_KEY` and `EZVIZ_APP_SECRET` into module-level variables but never uses those values. Instead, `main()` requires both credentials as positional command-line arguments. This behavior contradicts the Skill documentation, which identifies environment variables as the preferred and highest-priority credential source. Command-line arguments are commonly visible through process-inspection facilities, diagnostic tooling, shell history, orchestration logs, audit records, and job definitions. The problem is especially significant for the AppSecret because compromise of the long-lived application credential may allow an ...[truncated 1349 chars]

Remediation

View remediation

[params...]") sys.exit(1) command = sys.argv[1] args = sys.argv[2:] if not app_key or not app_secret: print("[ERROR] Set EZVIZ_APP_KEY and EZVIZ_APP_SECRET") sys.exit(1) ``` 2. Remove positional secret arguments from the normal interface and from all examples. 3. If an alternative input method is required, use a protected credential file, standard input, a no-echo prompt through `getpass`, or an operating-system secret store. 4. If command-line credential compatibility must temporarily remain, require an explicit deprecated option and display a warning about process-list and shell-history exposure. 5. Update usage text and documentation so that the actual credential precedence exactly matches the implementation. 6. Rotate any AppSecret that may already have been exposed through shell history, logs, or process monitoring. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: lib/token_manager.py:42

Finding

Predictable Shared Temporary Cache Permits Symlink and Permission Attacks

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill emphasizes environment-variable credentials, but the finding indicates the main entry point accepts secrets on the command line and exposes additional undeclared device-control features such as capacity and mirror operations. Passing secrets via argv is risky because they may be exposed through shell history, process listings, or logs, and undeclared control functions expand operational impact without clear review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill emphasizes environment-variable credentials, but the finding indicates the main entry point accepts secrets on the command line and exposes additional undeclared device-control features such as capacity and mirror operations. Passing secrets via argv is risky because they may be exposed through shell history, process listings, or logs, and undeclared control functions expand operational impact without clear review.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.

cat /tmp/ezviz_global_token_cache/global_token_cache.json

清除缓存

rm -rf /tmp/ezviz_global_token_cache/

text

### 验证命令

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

cat /tmp/ezviz_global_token_cache/global_token_cache.json

清除缓存

rm -rf /tmp/ezviz_global_token_cache/

text

### 验证命令

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.

cat /tmp/ezviz_global_token_cache/global_token_cache.json

清除缓存

rm -rf /tmp/ezviz_global_token_cache/

text

### 验证命令

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

cat /tmp/ezviz_global_token_cache/global_token_cache.json

清除缓存

rm -rf /tmp/ezviz_global_token_cache/

text

### 验证命令

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

2. 环境变量安全

bash

# 推荐：使用 .env 文件（不要提交到版本控制）
echo "EZVIZ_APP_KEY=your_key" >> .env
echo "EZVIZ_APP_SECRET=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.

2. 环境变量安全

bash

# 推荐：使用 .env 文件（不要提交到版本控制）
echo "EZVIZ_APP_KEY=your_key" >> .env
echo "EZVIZ_APP_SECRET=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 404)May include surrounding context.

2. 环境变量安全

bash

# 推荐：使用 .env 文件（不要提交到版本控制）
echo "EZVIZ_APP_KEY=your_key" >> .env
echo "EZVIZ_APP_SECRET=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

2. 环境变量安全

bash

# 推荐：使用 .env 文件（不要提交到版本控制）
echo "EZVIZ_APP_KEY=your_key" >> .env
echo "EZVIZ_APP_SECRET=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.

2. 环境变量安全

bash

# 推荐：使用 .env 文件（不要提交到版本控制）
echo "EZVIZ_APP_KEY=your_key" >> .env
echo "EZVIZ_APP_SECRET=your_secret" >> .env
chmod 600 .env

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although the command targets a specific cache directory, the README recommends recursive force deletion in a temp path. If copied into scripts or modified carelessly, this pattern can lead to unintended data loss, especially on shared systems or if variables/path assumptions are later introduced around the deletion logic.

Content

Scanner excerpt · lib/README_TOKEN_MANAGER.md (reported line 183)May include surrounding context.

bash

# 清除所有缓存
rm -rf /tmp/ezviz_global_token_cache/

# 或使用 CLI
python3 token_manager.py clear

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although the command targets a specific cache directory, the README recommends recursive force deletion in a temp path. If copied into scripts or modified carelessly, this pattern can lead to unintended data loss, especially on shared systems or if variables/path assumptions are later introduced around the deletion logic.

Content

Scanner excerpt · lib/README_TOKEN_MANAGER.md (reported line 183)May include surrounding context.

bash

# 清除所有缓存
rm -rf /tmp/ezviz_global_token_cache/

# 或使用 CLI
python3 token_manager.py clear

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md

def get_cached_token(app_key, app_secret, use_cache=None):
    """
    Get access token, using cached version if available and valid.
    
    Args:
        app_key: Ezviz app key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

md

def get_cached_token(app_key, app_secret, use_cache=None):
    """
    Get access token, using cached version if available and valid.
    
    Args:
        app_key: Ezviz app key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/token_manager.py (reported line 120)May include surrounding context.

python

def get_cached_token(app_key, app_secret, use_cache=None):
    """
    Get access token, using cached version if available and valid.
    
    Args:
        app_key: Ezviz app key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/token_manager.py (reported line 173)May include surrounding context.

python

def get_cached_token(app_key, app_secret, use_cache=None):
    """
    Get access token, using cached version if available and valid.
    
    Args:
        app_key: Ezviz app key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/token_manager.py (reported line 189)May include surrounding context.

python

def get_cached_token(app_key, app_secret, use_cache=None):
    """
    Get access token, using cached version if available and valid.
    
    Args:
        app_key: Ezviz app key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 259)May include surrounding context.

python

def get_cached_token(app_key, app_secret, use_cache=None):
    """
    Get access token, using cached version if available and valid.
    
    Args:
        app_key: Ezviz app key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The CLI prints the first 30 characters of the access token to stdout. Partial token disclosure in logs, terminals, CI output, or agent transcripts can materially aid credential compromise, especially if token formats are predictable or if logs are broadly accessible; in this skill context, the token grants cloud-device control, making leakage more dangerous.

Content

Scanner excerpt · lib/token_manager.py (reported line 361)May include surrounding context.

python

result = get_cached_token(args.app_key, args.app_secret, use_cache=use_cache)
        
        if result["success"]:
            print(f"\nAccess Token: {result['access_token'][:30]}...")
            print(f"Expires: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(result['expire_time'] / 1000))}")
            print(f"From Cache: {result['from_cache']}")
        else:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents effective capabilities including environment-variable access, local file read/write, network access, and shell execution, but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability because an agent may be able to invoke more powerful operations than a consumer expects from the metadata alone.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

md

# 推荐：使用 .env 文件（不要提交到版本控制）
echo "EZVIZ_APP_KEY=your_key" >> .env
echo "EZVIZ_APP_SECRET=your_secret" >> .env
chmod 600 .env

# 加载环境变量
source .env

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description and all operational guidance are written in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill manifest describes controlling Ezviz PTZ devices, querying device status, and managing presets. This documentation introduces a separate command-line token manager with commands to get, refresh, list, and clear shared tokens, which is an account/credential-management capability rather than an obvious end-user PTZ control feature.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README documents commands to list all cached tokens and clear all cached tokens across accounts, which exceeds the least-privilege needs of a PTZ/device-control skill. In a shared host environment, such cross-account cache administration can enable unintended visibility into other tenants' token metadata or denial of service by deleting valid cached credentials for unrelated accounts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.