ClawHub
Back to skill

Security audit

TG Cam App

Security checks for vulnerabilities and agentic risk

Overview

This camera skill does what it claims, but it tells the agent to persist sensitive camera API credentials from chat into a local config file.

Review before installing. Only use this if you trust the camera provider and are comfortable giving the skill access to camera device lists, snapshots, event images, status, and battery data. Prefer configuring TIVS_CLI_ID and TIVS_API_KEY through OpenClaw's secure environment or secret mechanism rather than pasting them into chat, and check openclaw.json for stored secrets if you do provide credentials during a session.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Ssd 3

High
Confidence
97% confidence
Finding
The skill explicitly instructs the agent to take credentials received in chat and persist them into `openclaw.json`. Persisting secrets from conversational input into a local config file increases the risk of credential leakage through logs, later prompts, workspace exposure, backups, or cross-session reuse, and it normalizes handling highly sensitive API keys in an unsafe channel.

Static analysis

No suspicious patterns detected.