FTTR Operator Copilot
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This appears to be a coherent FTTRAI operator API client, but it uses a sensitive operator token and can perform limited provider-side actions such as marking alerts read.
Before installing, confirm that this agent is allowed to use an FTTRAI operator token and view managed-device/network data. Use a least-privileged token, keep FTTRAI_RPC_URL on a trusted HTTPS endpoint, and require confirmation before marking alerts as read or running real-time device query commands.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can query operator-visible managed devices, alerts, topology, metrics, and diagnostics using the supplied token.
The skill requires a bearer token that delegates operator API access to the agent; this is expected for the integration but gives the agent access to whatever devices and regions the token can reach.
FTTRAI_OPERATOR_AUTH_TOKEN ... Operator bearer token used to call FTTRAI operator APIs. ... Operator tools are scoped by the token user's region and permissions.
Use a least-privileged operator token, keep it out of chat/logs, rotate it if exposed, and install this only in an environment where the agent is allowed to view FTTRAI operator data.
If invoked unintentionally, an alert could be marked read or a device query command could be sent under the operator identity.
The skill includes a provider-side state change and device query command dispatch, but these capabilities are disclosed, scoped to alert IDs or device identifiers, and aligned with the operator workflow.
`mark_alerts_as_read`: Mark alert IDs as read. This writes to FTTRAI state. ... `mark_alerts_as_read` writes state; confirm intent before using it. ... Real-time command tools send device query commands
Require explicit user confirmation before marking alerts read, and use real-time command tools only for devices the operator is authorized to inspect.
A misconfigured endpoint could send the operator token and FTTRAI requests somewhere unsafe.
The configurable RPC base URL accepts both HTTP and HTTPS; because authenticated RPC calls use this base URL, setting it to an untrusted or plaintext HTTP endpoint could expose the bearer token.
if (!["http:", "https:"].includes(parsedUrl.protocol)) { ... FTTRAI_RPC_URL 只支持 http 或 httpsLeave the default HTTPS endpoint unless you have a trusted FTTRAI backend, and avoid plain HTTP for bearer-token traffic.