hik-connect-team-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:21 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for Hik-Connect device management, but it handles high-impact device access and credentials with enough unsafe practices that it should go through Review before installation.

Install only after reviewing and hardening credential handling. Rotate or verify the published-looking app key/secret, disable or move the token cache to a private secure store, validate Hik-Connect area domains before sending tokens, use least-privilege HCT credentials, and require explicit operator confirmation for door-control, webhook, tunnel, and event-subscription actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: lib/README_TOKEN_MANAGER.md:156

Finding

Credential-Like AppKey and SecretKey Committed to Documentation

Content

View full analysis

Remediation

View remediation

" \ --app-secret "" ``` 4. Search the complete version-control history, release archives, build artifacts, and logs for the exposed values. 5. Enable automated secret scanning in CI and pre-commit workflows. 6. Configure the replacement application credentials with only the API permissions needed for the intended module. 7. Review Hik-Connect audit logs for token issuance or API requests associated with the exposed key. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: lib/token_manager.py:125

Finding

Access Token Forwarded to an Unvalidated Server-Provided Domain

Content

View full analysis

0) ) } response = requests.request( method, url, headers=headers, json=json_data, params=params, timeout=30 ) ``` ### Technical Analysis Sending the AppKey and SecretKey to the fixed Hik-Connect HTTPS token endpoint is necessary for the declared functionality. The security issue occurs after token acquisition: the client accepts `areaDomain` from the token response and uses it as the destination for all authenticated requests. No validation ensures that: - ...[truncated 1887 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: lib/token_manager.py:75

Finding

Predictable Plaintext Token Cache Is Created Without Safe Ownership or Symlink Controls

Content

View full analysis

Dict[str, Any]: if not os.path.exists(self.cache_file): return {} try: with open(self.cache_file, "r") as f: return json.load(f) except Exception as e: print(f"[WARNING] Failed to load Token cache: {e}", file=sys.stderr) return {} def _save_cache(self, cache_data: Dict[str, Any]): try: temp_file = self.cache_file + ".tmp" with open(temp_file, "w") as f: json.dump(cache_data, f, indent=2) os.replace(temp_file, self.cache_file) if os.name != 'nt': os.chmod(self.cache_file, 0o600) except Exception as e: print(f"[WARNING] Failed to save Token cache: {e}", file=sys.stderr) ``` ### Technical Analysis The cache uses a globally predictable path under the system temporary directory: ```text /tmp/hctopen_global_token_cache/global_token_cache.json ``` The implementation does not verify that the directory: - Is owned by the current user. - Has private permissions such as `0700`. - Is not a symbolic link. - Was created securely by this process. The temporary file name, `global_token_cache.json.tmp`, is also predictable. It is opened with the normal `open(..., "w")` operation, without exclusive creation or no-follow semantics. File mode `0600` is applied only after plaintext access tokens have already been written and renamed. The cache itself is plaintext JSON. Several module documents describe it as encrypted, but the implementation performs no encry ...[truncated 1546 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: modules/Hik-Connect_Team_Alarm/scripts/package.json:10

Finding

Third-Party Dependencies Are Installed Without Reproducible Version and Integrity Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (62)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 180)May include surrounding context.

2. Environment Variable Security

bash

# Recommended: Use .env file (do not commit to version control)
echo "HIK_CONNECT_TEAM_OPENAPI_APP_KEY=your_key" >> .env
echo "HIK_CONNECT_TEAM_OPENAPI_SECRET_KEY=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 181)May include surrounding context.

2. Environment Variable Security

bash

# Recommended: Use .env file (do not commit to version control)
echo "HIK_CONNECT_TEAM_OPENAPI_APP_KEY=your_key" >> .env
echo "HIK_CONNECT_TEAM_OPENAPI_SECRET_KEY=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 182)May include surrounding context.

2. Environment Variable Security

bash

# Recommended: Use .env file (do not commit to version control)
echo "HIK_CONNECT_TEAM_OPENAPI_APP_KEY=your_key" >> .env
echo "HIK_CONNECT_TEAM_OPENAPI_SECRET_KEY=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 183)May include surrounding context.

2. Environment Variable Security

bash

# Recommended: Use .env file (do not commit to version control)
echo "HIK_CONNECT_TEAM_OPENAPI_APP_KEY=your_key" >> .env
echo "HIK_CONNECT_TEAM_OPENAPI_SECRET_KEY=your_secret" >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 186)May include surrounding context.

2. Environment Variable Security

bash

# Recommended: Use .env file (do not commit to version control)
echo "HIK_CONNECT_TEAM_OPENAPI_APP_KEY=your_key" >> .env
echo "HIK_CONNECT_TEAM_OPENAPI_SECRET_KEY=your_secret" >> .env
chmod 600 .env

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 198)May include surrounding context.

4. Regular Cache Cleanup

bash

# Clear all cached Tokens
rm -rf /tmp/hctopen_global_token_cache/

5. Config File Scanning

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 198)May include surrounding context.

4. Regular Cache Cleanup

bash

# Clear all cached Tokens
rm -rf /tmp/hctopen_global_token_cache/

5. Config File Scanning

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 262)May include surrounding context.

md

## 🔒 Security & Best Practices

- **Least Privilege**: Use credentials with only the permissions necessary for your specific task.
- **Token Caching**: Skills automatically caches access tokens in system temp directory (600 permissions) to minimize API calls.
- **HTTPS**: All Webhook endpoints **must** use HTTPS.
- **Stream Encryption**: If devices have "Stream Encryption" enabled, you must manually decrypt in HCT platform or app.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose is Hik-Connect Team device management, but the detected behavior includes reading unrelated local OpenClaw configuration and tokens and contacting a localhost OpenClaw gateway endpoint. This mismatch is dangerous because it expands trust assumptions: a user invoking an HCT device skill would not expect inspection of local auth material or communication with auxiliary local services, which can enable credential exposure, local service abuse, or stealthy lateral interaction.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The test examples appear to contain plaintext app credentials, which is a direct secret exposure if authentic and a strong anti-pattern even if synthetic. In the context of a skill that controls devices and retrieves media/resources, compromised credentials could enable broad unauthorized access, token generation, and operational misuse.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 97% confidence

Finding

The instruction to send received webhook messages verbatim to notification channels operationalizes exfiltration of incoming alarm data to external messaging services such as Feishu or Telegram. Even if intended for alerting, this creates a direct path for sensitive telemetry and identifiers to leave the controlled processing environment without review, minimization, or destination validation.

Content

Scanner excerpt · modules/Hik-Connect_Team_Alarm/SKILL.md (reported line 507)May include surrounding context.

md

**Required Behavior:**
- ✅ **DO**: Forward the received message content verbatim to the user
- ✅ **DO**: Send the message to the configured notification channel (Feishu/Telegram/etc.)
- ❌ **DO NOT**: Summarize, interpret, or rephrase the message
- ❌ **DO NOT**: Translate the message (e.g., from Chinese to English or vice versa)
- ❌ **DO NOT**: Add comments, analysis, or extra explanations

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises remote door control as a feature but does not clearly warn that this can affect physical access and safety, and should only be used with explicit authorization and operational safeguards. In a skill intended for controlling security devices, omission of that warning increases the risk of unsafe or unauthorized use by downstream users or agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The webhook setup instructions tell users to expose an internet-reachable receiver but do not prominently warn that alarm/event payloads may contain sensitive security telemetry and that public exposure expands attack surface. Without guidance on source validation, secret verification, rate limiting, logging hygiene, and network restrictions, users may deploy an insecure receiver.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 174)May include surrounding context.

md

## 🔒 Security Recommendations

### 1. Use Minimal Permission Credentials
- Create dedicated `HIK_CONNECT_TEAM_OPENAPI_APP_KEY`/`HIK_CONNECT_TEAM_OPENAPI_SECRET_KEY` with only necessary API permissions
- Do not use main account credentials
- Rotate credentials regularly (recommended every 90 days)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 183)May include surrounding context.

md

# Recommended: Use .env file (do not commit to version control)
echo "HIK_CONNECT_TEAM_OPENAPI_APP_KEY=your_key" >> .env
echo "HIK_CONNECT_TEAM_OPENAPI_SECRET_KEY=your_secret" >> .env
chmod 600 .env

# Load environment variables
source .env

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises significant capabilities including environment access, local file read/write, network, and shell-like execution pathways, but it does not declare any explicit tool scope or permission boundaries. In an agent setting this creates an overprivileged integration surface where the agent may access secrets, local files, or external services beyond what a user would reasonably infer from the metadata.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

This Skills consists of five core sub-modules, each providing deep support for specific business scenarios:

| Module Name                                                                | Core Functions                                            | Core Scripts                                                                       | Applicable Scenarios                                                                                                                          |
|:---------------------------------------------------------------------------|:----------------------------------------------------------|:-----------------------------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------|
| [**📦 Resource Management**](./modules/Hik-Connect_Team_Resource/SKILL.md) | Device discovery, detail acquisition, channel enumeration | `list_devices.py`<br>`device_detail.py`<br>`device_channels.py`<br>`list_doors.py` | Asset inventory, obtaining device serial numbers and channel IDs, access control resources, synchronizing organizational structure resources. |
| [**🚪 Access Control (ACS)**](./modules/Hik-Connect_Team_ACS/SKILL.md)     | Remote open/close, normally open/normally closed control  | `acs_control.py`                                                                   | Remote office collaboration, unattended entrance management, access control linkage in emergencies.                                           |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/README_TOKEN_MANAGER.md (reported line 17)May include surrounding context.

md

- **Smart Reuse**: Use cache directly during Token validity period, no API calls
- **Safe Buffer**: Auto-refresh 5 minutes before expiration to avoid boundary issues
- **Multi-Account Support**: Identify different accounts based on md5(appKey:appSecret)
- **Atomic Write**: Write to temporary file first then replace, ensuring data safety
- **Permission Protection**: Cache file permission set to 600 (owner read/write only)

## 🔐 Credential Configuration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example explicitly prints the access token to stdout, which can leak bearer credentials into terminal scrollback, logs, notebook output, support bundles, or screenshots. Since the token grants authenticated access to HCT APIs, anyone who obtains it may be able to act as the account until expiration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README instructs users to pass long-lived app credentials directly on the command line, which exposes secrets to shell history, process listings, audit logs, and screenshots. In a device-management skill that already supports environment variables and config-based discovery, this guidance unnecessarily increases the chance of credential compromise.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation includes live-looking tokens and credential-like values in example cache content, which encourages unsafe handling of sensitive material and may expose real secrets if copied from production-like data. For a token manager, showing full token formats in persisted JSON also makes it easier for users to overlook the sensitivity of cached bearer tokens.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README shows full app key and secret values in shell commands without warning that shell history, terminal recording, CI logs, or shared documentation can capture them. Because these are bearer-like long-lived API credentials for device management, disclosure could directly enable unauthorized API use and downstream token issuance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples include full, real-looking app secrets in a security-focused document, normalizing disclosure of credential material and risking accidental reuse if those values are valid. In documentation for a remote device-management integration, exposed API credentials could enable unauthorized access to managed devices or tenant resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Access tokens are persisted to a shared temporary-directory cache file, which increases the risk of token disclosure on multi-user systems, container hosts, or environments with weak temp-directory isolation. Although the file is chmodded to 0600 on Unix after write, use of a predictable temp path and non-atomic permission control can still leave tokens exposed or improperly handled across platforms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The code sends appKey and secretKey to an external HTTPS endpoint to obtain a token, which is a security-relevant network operation involving sensitive credentials. There is no confirmation prompt, warning log, or inline disclosure informing users that their credentials will be transmitted over the network.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: modules/Hik-Connect_Team_Alarm/scripts/server.js:79

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: lib/token_manager.py:180