ClawHub

jf-open-pro-device-smart-alarm

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill matches its smart-alarm purpose, but it handles sensitive alarm credentials and image data while allowing the API destination to be changed without validation.

Review this carefully before installing. Only use it with a trusted JF_ENDPOINT value from the documented regional domains, avoid exposing credentials in shared shells or logs, and understand that the commands can change alarm settings and print alarm event details and image URLs.

SkillSpector (8)

By NVIDIA

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
headers = get_headers(uuid, app_key, app_secret, move_card)
    headers["DeviceSn"] = device_sn
    
    response = requests.get(url, headers=headers, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
92% confidence
Finding
response = requests.get(url, headers=headers, timeout=30)

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"accessToken": access_token
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
96% confidence
Finding
response = requests.post(url, headers=headers, json=body, timeout=30)

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
url = f"{JF_BASE_URL}/rtc/device/getability/{device_token}"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    
    response = requests.post(url, headers=headers, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
91% confidence
Finding
response = requests.post(url, headers=headers, timeout=30)

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
94% confidence
Finding
response = requests.post(url, headers=headers, json=body, timeout=30)

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Detect.MotionDetect": config
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
response = requests.post(url, headers=headers, json=body, timeout=30)

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if alarm_event:
        body["alarmEvent"] = alarm_event
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
93% confidence
Finding
response = requests.post(url, headers=headers, json=body, timeout=30)

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if events:
        body["events"] = events
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
94% confidence
Finding
response = requests.post(url, headers=headers, json=body, timeout=30)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill description instructs users to provide highly sensitive device and platform credentials and also advertises access to alarm messages and image URLs, but it does not include any privacy, retention, or handling warnings. In this context, alarm images and event history can reveal occupancy patterns, interior scenes, and other sensitive household or business information, so omission of safeguards materially increases privacy and security risk.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal