ClawHub
Back to skill

Security audit

Webcam

Security checks for vulnerabilities and agentic risk

Overview

This camera skill is purpose-aligned and instruction-only, but users should understand it can access private camera images and stores provided API credentials locally.

Install only if you trust the camera service endpoint and are comfortable letting the agent access snapshots, event images, device status, and battery data for bound cameras. Treat TIVS_CLI_ID and TIVS_API_KEY as private camera credentials; if you provide them, this skill tells the agent to store them in openclaw.json, so remove or rotate them later if you no longer want persistent access.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to persist `TIVS_CLI_ID` and `TIVS_API_KEY` into `openclaw.json`, expanding behavior beyond transient API use into local secret storage. Persisting credentials on disk increases exposure to later leakage, reuse by unrelated skills, or compromise through local file access, and this persistence is not necessary to answer a single webcam query.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Credential persistence is not justified by the skill's stated purpose of querying devices, snapshots, events, status, and battery. Storing API keys locally creates an unnecessary long-lived trust expansion: if the host or config file is later accessed, an attacker could query private camera data or device metadata without re-consent.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill enables access to live snapshots, event images, and historical camera events, all of which are highly privacy-sensitive, but it does not warn about the privacy implications or encourage user confirmation before revealing such content. In a camera context, omission of privacy safeguards increases the chance of exposing images of people, homes, routines, or other sensitive scenes without adequate notice.

Static analysis

No suspicious patterns detected.