Webcam Motion Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:33 AM UTC
• Version: 1.0.3

Overview

The skill is a real webcam-monitoring package, but it exposes a live webcam server on all network interfaces without authentication and recommends overly broad camera-device permissions.

Install only after reviewing the webcam exposure risks. Change the preview server to bind to 127.0.0.1 or add authentication before running it, do not use chmod 666 for /dev/video0, and be careful with stored snapshots, automatic deletion, and any person-identification memory entries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/web_preview.py:118

Finding

Unauthenticated Live Webcam Exposure on All Network Interfaces

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:114

Finding

World-Readable and World-Writable Webcam Device Permission Recommendation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code clearly fits part of the description: it uses a webcam, detects motion, saves snapshots, and logs monitoring events. However, the declared purpose is significantly broader and includes WSL2 with USB/IP passthrough support, monitoring camera snapshots, auto-analyzing images with AI, and managing webcam-based security monitoring for specific camera setups. None of those broader or specialized capabilities appear in this code chunk. The actual behavior is a straightforward headless OpenCV motion detector operating on local camera device 0 with file logging and snapshot capture. Because key declared capabilities are absent and the description materially overstates what this code does, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code is clearly webcam-related, so it partially overlaps with the declared domain. However, the description emphasizes a motion detection and monitoring system for WSL2 with USB/IP passthrough, including automated image analysis and security/activity monitoring workflows. This code does not implement motion detection, automated monitoring logic, AI analysis, or any USB/IP/WSL2 configuration behavior. Instead, it provides a simple local web preview server with live streaming and a manual snapshot button. That is a materially narrower and different primary purpose than the declared description.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The command sudo chmod 666 /dev/video0 is an unsafe parameter recommendation because it applies an overly broad permission mode to a sensitive device. This weakens local security controls and can be abused by other local users or processes to access or disrupt the camera.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Permission denied

bash

sudo chmod 666 /dev/video0

Camera in use

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Exposing live camera data on all network interfaces without warning or access controls is dangerous because webcam imagery is highly sensitive and can reveal occupants, activities, and surroundings. In the context of a monitoring skill, this is more dangerous than a generic HTTP service because the data is inherently privacy-sensitive and the /snapshot endpoint can also persist images to disk remotely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill describes behaviors that involve writing files and exposing a web service, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent executes file-write or network-capable actions without clear user visibility or least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises automatic deletion of snapshots without a clear warning that data will be destructively removed on a schedule. Users may unintentionally lose evidence or important records, especially in a security-monitoring context where snapshots may be needed later.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Setting /dev/video0 to mode 666 makes the webcam world-readable and world-writable, allowing any local process or user to access the camera device. In a monitoring skill, this is especially dangerous because it can enable unauthorized camera use, privacy compromise, or interference with capture operations.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Permission denied

bash

sudo chmod 666 /dev/video0

Camera in use

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Setting /dev/video0 to mode 666 makes the webcam world-readable and world-writable, allowing any local process or user to access the camera device. In a monitoring skill, this is especially dangerous because it can enable unauthorized camera use, privacy compromise, or interference with capture operations.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Permission denied

bash

sudo chmod 666 /dev/video0

Camera in use

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages collecting, storing, and analyzing identifiable webcam images and personal traits without an explicit privacy warning, consent guidance, or retention safeguards. This can lead to privacy violations, unauthorized surveillance, and mishandling of sensitive biometric or identifying data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly tell users to store detailed person-identification data such as name, appearance, clothing, jewelry, and environment for AI analysis of webcam snapshots. In context, this is more dangerous because the skill is for persistent camera monitoring, making it easy to build sensitive profiles of identifiable individuals and enabling intrusive surveillance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

#!/usr/bin/env python3.10
"""
Snapshot Watcher with Auto-Cleanup
Watches for new snapshots AND automatically deletes old ones
"""

import os

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/watcher_with_cleanup.py (reported line 4)May include surrounding context.

python

#!/usr/bin/env python3.10
"""
Snapshot Watcher with Auto-Cleanup
Watches for new snapshots AND automatically deletes old ones
"""

import os

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code deletes snapshot and queue files via unlink() on a timer, which is a destructive operation. Although the file has a top-level docstring and logs that cleanup occurs, there is no confirmation step or stronger user-facing warning before irreversible deletion begins.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code saves camera images into a persistent directory under the user's home folder, which affects user data/privacy. Although there is a runtime print after saving, there is no prior disclosure in the file's docstring, comments, or UI text warning that snapshots will be stored locally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The server binds to 0.0.0.0, making the live webcam feed reachable from other hosts on the network rather than only the local machine. In a webcam-monitoring skill, this materially increases exposure because anyone with network access to the port can view sensitive camera data and trigger snapshot capture without authentication.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring claims the preview is served at localhost:8080, but the code actually listens on 0.0.0.0:8081. This mismatch can mislead users into believing the feed is local-only when it is in fact exposed on all interfaces, increasing the chance of accidental data exposure.

Content

No source excerpt is available for this finding.