hik-connect-team-skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:36 PM UTC
• Version: 1.0.0

Overview

This is a mostly coherent Hik-Connect integration, but it needs Review because it can remotely unlock doors and one instruction allows default open-door execution without clear affirmative consent.

Install only if you trust the publisher and can use dedicated least-privilege HCT credentials. Require explicit user confirmation before any ACS door action, especially open or normally-open operations, and avoid running the alarm webhook on an exposed host without HTTPS, signature verification, and a tightly scoped OpenClaw notification target. Treat cached tokens, stream URLs, capture URLs, and alarm messages as sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities requiring access to environment variables, local config files, network communication, shell-based dependency installation, and token/cache storage, but it declares no explicit permissions. This creates a transparency and least-privilege problem: users or execution frameworks may authorize or sandbox it incorrectly, while the skill still expects access to sensitive credentials and local files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The top-level description says modules require environment-variable-based HCT credentials, but the skill also falls back to reading local OpenClaw config files and, per the finding, interacts with local hook/gateway infrastructure and receives webhook traffic. That mismatch is dangerous because operators may approve the skill under a narrower trust model than its actual behavior, leading to unexpected credential discovery, local integration exposure, and network-accessible webhook handling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises remote door control as a feature but does not prominently warn that these actions can affect physical security and occupant safety. In a security-device control skill, normalizing door open/close operations without explicit authorization and safety guidance increases the risk of misuse, accidental unlocking, or deployment in inappropriate contexts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example command shows how to remotely open a door but omits any caution about verifying authorization, confirming the target door, or understanding downstream physical consequences. Because this is an operational example for a live access-control action, users may execute it directly without appreciating that it can bypass normal access procedures or create safety incidents.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The README includes example commands and sample output that display full app secrets and access tokens. Even in documentation, realistic-looking secrets normalize unsafe handling and can lead users to paste real credentials into shells, terminal history, logs, screenshots, or shared documentation, causing credential compromise.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The test examples show full app-secret values directly in command lines without warning about shell history or process-list exposure. In this skill context, those credentials grant access to device-management and monitoring APIs, so accidental disclosure could enable unauthorized API use across managed HCT resources.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to proceed with a default open-door action after merely informing the user, even if there is no explicit confirmation. Because this controls physical door access, defaulting to execution without affirmative consent can lead to unauthorized unlocking, physical intrusion, and real-world safety incidents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation includes full example video stream URLs that appear to be bearer-style access links containing signed query parameters and identifiers. Even if these are sample values, publishing complete access URL formats without treating them as secrets normalizes unsafe handling and may lead operators or logs to expose live stream links that grant unauthorized viewing until expiration.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script prints the full video stream URL to stdout, and these URLs commonly function as bearer-style access tokens for live video access until expiration. In agent, CI, shell-history, or centralized logging environments, stdout is often captured and retained, so anyone with log access could reuse the URL to view device video without needing the original credentials.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs forwarding webhook payloads 'exactly as-is' to downstream notification channels without redaction, minimization, or sensitivity checks. Alarm payloads may contain device identifiers, timestamps, location/context, serial numbers, and user-related metadata, so verbatim forwarding can leak sensitive operational data to external messaging platforms or unintended recipients.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: modules/Hik-Connect_Team_Alarm/scripts/server.js:79

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: lib/token_manager.py:180