ClawHub
Back to skill

Security audit

jf-open-pro-ai-child-care

Security checks for vulnerabilities and agentic risk

Overview

This child-monitoring skill is largely purpose-aligned, but it needs review because it handles sensitive home/child data and credentials while exposing secrets through command-line arguments and ignoring its documented regional endpoint setting.

Install only if you trust JF Tech with the child-care, household, device, and account data involved. Before use, verify the intended data region, avoid passing long-lived secrets on the command line, rotate any credentials already used that way, and require explicit human approval for enabling/disabling analysis or changing stranger/person-library entries.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/alarm_query.py:138
Finding

Sensitive API credentials are exposed through command-line arguments

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/alarm_query.py:138-143
  • scripts/child_care.py:150-155
  • scripts/stranger_manager.py:161-166
  • scripts/stats_query.py:278-283

Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

scripts/alarm_query.py:138-143:

python
parser.add_argument("--uuid", required=True, help="开放平台用户 uuid")
parser.add_argument("--appkey", required=True, help="应用 appKey")
parser.add_argument("--secret", required=True, help="应用密钥")
parser.add_argument("--auth", required=True, help="用户 token")
parser.add_argument("--movecard", type=int, required=True, help="移动卡标识")
parser.add_argument("--msg-type", required=True,

scripts/child_care.py:150-155:

python
parser.add_argument("--uuid", required=True, help="开放平台用户 uuid")
parser.add_argument("--appkey", required=True, help="应用 appKey")
parser.add_argument("--secret", required=True, help="应用密钥")
parser.add_argument("--auth", required=True, help="用户 token")
parser.add_argument("--movecard", type=int, required=True, help="移动卡标识")
parser.add_argument("--enable", type=str, choices=["true", "false"],

scripts/stranger_manager.py:161-166:

python
parser.add_argument("--uuid", required=True, help="开放平台用户 uuid")
parser.add_argument("--appkey", required=True, help="应用 appKey")
parser.add_argument("--secret", required=True, help="应用密钥")
parser.add_argument("--auth", required=True, help="用户 token")
parser.add_argument("--movecard", type=int, required=True, help="移动卡标识")
parser.add_argument("--alarm-id", required=True, help="报警 ID")

scripts/stats_query.py:278-283:

python
parser.add_argument("--uuid", required=True, help="开放平台用户 uuid")
parser.add_argument("--appkey", required=True, help="应用 appKey")
parser.add_argument("--secret", required=True, help="应用密钥")
parser.add_argument("--auth", required=True, help="用户 to
...[truncated 2585 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove --secret and --auth from the command-line interface.
  2. Read credentials from the documented JF_APP_SECRET and JF_AUTHORIZATION environment variables, or preferably from a permission-restricted secret manager.
  3. Permit non-sensitive operational values on the command line while keeping authentication material out of process arguments.
  4. Fail safely when required credentials are unavailable; do not prompt in contexts where input may be echoed or logged.
  5. Ensure exceptions, diagnostics, and verbose output never include authorization headers, secrets, signatures, or complete reconstructed requests.
  6. Add automated tests that verify secrets do not appear in process arguments or program output.
  7. Document token expiration and rotation procedures, and rotate credentials that may previously have been used through the vulnerable interface.
  8. Where supported, use short-lived, narrowly scoped authorization tokens to limit the impact of exposure.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/child_care.py:45
Finding

Documented regional endpoint selection is ignored, causing sensitive requests to be sent to a hardcoded region

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/alarm_query.py:50
  • scripts/child_care.py:45,94
  • scripts/stranger_manager.py:47,100
  • scripts/stats_query.py:50,105,160
  • SKILL.md:13-17,91

Vulnerability Type: Hardcoded endpoint and ineffective regional security configuration
Risk Level: Medium

Vulnerable Code

scripts/alarm_query.py:50:

python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/alarm/page"

scripts/child_care.py:45:

python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/ai/analysis/switch/get"

scripts/child_care.py:94:

python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/ai/analysis/switch/change"

scripts/stranger_manager.py:47:

python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/stranger/add"

scripts/stranger_manager.py:100:

python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/stranger/remove"

scripts/stats_query.py:50,105,160:

python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/static/queryCount"
python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/static/queryTime"
python
url = "https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/static/queryTimeForChart"

The documentation declares CN, AS, EU, and NA endpoints and defines JF_ENDPOINT as an optional endpoint configuration, but none of the scripts read or apply that setting.

Technical Analysis

Every network operation is hardcoded to api-cn.jftechws.com. Consequently, users cannot enforce the region selected in the Skill configuration, and the documented JF_ENDPOINT control has no effect.

Requests contain sensitive authentication and monitoring information, including:

  • Authorization tokens and request signatures.
  • User UUIDs and application identifiers.
  • Device serial numbe ...[truncated 1780 chars]
Remediation
View remediation

Remediation Suggestions

  1. Implement endpoint selection through the documented JF_ENDPOINT setting or an explicit region parameter.
  2. Map supported regions to a fixed allowlist:
    • CN: api-cn.jftechws.com
    • AS: api-as.jftechws.com
    • EU: api-eu.jftechws.com
    • NA: api-na.jftechws.com
  3. Reject arbitrary schemes, hosts, embedded credentials, ports, fragments, and path overrides. Only HTTPS endpoints from the allowlist should be accepted.
  4. Centralize endpoint construction in one shared helper rather than duplicating hardcoded URLs.
  5. Require explicit region selection when data-residency requirements apply; do not silently fall back to another region.
  6. Log the selected region without logging tokens, signatures, personal identifiers, device identifiers, or request bodies.
  7. Add tests confirming that every API operation uses the selected regional host and that unsupported hosts are rejected.
  8. Update the documentation so its endpoint defaults and actual runtime behavior are consistent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is framed as passive child-care monitoring, but it also exposes authenticated administrative operations to add or remove people from a backend stranger/person library. In a surveillance context, identity-list management is materially more sensitive than simple monitoring because it can alter detection outcomes and affect privacy or safety decisions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is framed as passive child-care monitoring, but it also exposes authenticated administrative operations to add or remove people from a backend stranger/person library. In a surveillance context, identity-list management is materially more sensitive than simple monitoring because it can alter detection outcomes and affect privacy or safety decisions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is framed as passive child-care monitoring, but it also exposes authenticated administrative operations to add or remove people from a backend stranger/person library. In a surveillance context, identity-list management is materially more sensitive than simple monitoring because it can alter detection outcomes and affect privacy or safety decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill describes continuous monitoring, alarm lookup, stranger management, and behavioral statistics involving children, but it does not present clear privacy, consent, retention, or surveillance-impact notices. In a home-child-monitoring context, missing privacy disclosure is serious because the data concerns minors, household occupants, and potentially biometric/person-identification workflows.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
| `SKILL.md` | 技能文档 |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents shell commands and networked API operations but does not declare any tool scope such as allowed tools or permissions. This creates an authorization and transparency gap: an agent may invoke shell/network capabilities more broadly than a reviewer or user expects, especially because the skill handles live credentials and remote administrative actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Broad trigger phrases increase the chance of accidental invocation, which is especially risky for a skill that can query surveillance data and perform remote administrative actions. Mis-triggering a privacy-sensitive monitoring skill can expose household activity information or lead to unintended state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code requires highly sensitive values (uuid, appkey, secret, and auth) as command-line arguments and then sends them in HTTP headers to a remote API. While the arguments are named clearly, there is no warning in comments, help text, or runtime output that these secrets will be exposed on the command line and transmitted over the network, which is a safety-relevant behavior for a code file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code generates a signed request using uuid, appkey, secret, movecard, and an authorization token, then sends them and device/user identifiers to an external HTTPS endpoint. Although the module docstring documents usage, it does not warn users that sensitive credentials and identifiers will be transmitted off-host, and there is no confirmation or runtime disclosure before doing so.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code accepts sensitive values including user ID, device serial number, UUID, appKey, secret, and authorization token, then sends them in HTTP headers and JSON bodies to a remote API. Although the script's purpose is querying stats, there is no confirmation prompt, print/log disclosure, or explicit user-facing warning at execution time that this personal/device data and credentials will be transmitted.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script performs state-changing operations against a remote 'stranger' database by adding and removing entries, which goes beyond passive child-monitoring and observation. In a child-care context, this expands the skill's effective authority and could let an operator alter security-relevant recognition behavior if the script is invoked with valid credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The CLI requires sensitive inputs such as appKey, secret, authorization token, device serial number, and user identifiers, then immediately transmits them to a remote API without a clear user-facing warning or confirmation. Passing secrets on the command line also risks exposure via shell history, process listings, and operational logs, making credential compromise more likely in real deployments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

该技能文档从描述、操作说明到注意事项均仅以中文呈现，未向用户提供语言/locale 选择，也未说明这是仅面向特定中文用户群体的必要限制。根据语言/locale 政策，这种默认强制单一语言且无用户选择的做法可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script's user-facing documentation, argument descriptions, and formatted output are all written in Chinese, which effectively fixes the interaction language without presenting any language or locale option. Under the policy, forced language selection is a natural-language violation unless the tool offers user choice or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's human-facing docstrings, help text, and status/error messages are entirely in Chinese, which imposes a specific language on users without opt-in or documented locale justification. The policy explicitly flags language or locale constraints when the skill does not offer a user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring and surrounding explanatory comments are written entirely in Chinese, which imposes a specific language on users and maintainers without any opt-in or documented locale constraint. Under the policy for natural-language violations, this is a language/locale restriction with no stated justification such as a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file's docstrings, CLI descriptions, help text, and formatted output are entirely in Chinese, which imposes a specific language on all users without offering a locale option. This is a natural-language policy concern because the skill does not provide any language selection or document that it is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language documentation and command descriptions in this file are entirely Chinese, and the script does not offer any alternative language or user-selectable locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.