ClawHub
Back to skill

Security audit

jf-open-pro-ai-elderly-care

Security checks for vulnerabilities and agentic risk

Overview

This elderly-care API skill is mostly purpose-aligned, but it handles sensitive care credentials/data and can change monitoring settings without adequate safeguards.

Install only if you trust the publisher and can protect the JF app secret, authorization token, device IDs, and elder-care records. Avoid passing secrets on the command line, review any service-disable or alert-threshold changes before running them, and account for the hard-coded China API endpoint and missing confirmation safeguards.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/elderly_care.py:172
Finding

Sensitive credentials exposed through command-line arguments

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/elderly_care.py:172-178
  • scripts/config_manager.py:141-146
  • scripts/alarm_query.py:137-142
  • scripts/stats_query.py:211-216
  • Supporting usage example: SKILL.md:447-454

Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: High

Vulnerable Code

scripts/elderly_care.py:172-178:

python
parser.add_argument("--sn", required=True, help="Device serial number")
parser.add_argument("--user", required=True, help="User ID")
parser.add_argument("--uuid", required=True, help="Open-platform user UUID")
parser.add_argument("--appkey", required=True, help="Application appKey")
parser.add_argument("--secret", required=True, help="Application secret")
parser.add_argument("--auth", required=True, help="User token (Authorization)")
parser.add_argument("--movecard", type=int, default=7, help="Move-card identifier used for signing")

scripts/config_manager.py:141-146:

python
parser.add_argument("--sn", required=True, help="Device serial number")
parser.add_argument("--user", required=True, help="User ID")
parser.add_argument("--uuid", required=True, help="Open-platform user UUID")
parser.add_argument("--appkey", required=True, help="Application appKey")
parser.add_argument("--secret", required=True, help="Application secret")
parser.add_argument("--auth", required=True, help="User token")

scripts/alarm_query.py:137-142:

python
parser.add_argument("--sn", required=True, help="Device serial number")
parser.add_argument("--user", required=True, help="User ID")
parser.add_argument("--uuid", required=True, help="Open-platform user UUID")
parser.add_argument("--appkey", required=True, help="Application appKey")
parser.add_argument("--secret", required=True, help="Application secret")
parser.add_argument("--auth", required=True, help="User token")

`scripts/stats_query.py: ...[truncated 4135 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --secret and --auth from the normal command-line interface.
  2. Read these values directly from protected environment variables such as JF_APP_SECRET and JF_AUTHORIZATION, without expanding them into command arguments.
  3. Prefer an operating-system credential store, secret manager, or configuration file with restrictive permissions when available.
  4. If interactive use is required, obtain secrets with getpass.getpass() so they are neither echoed nor stored in the argument vector.
  5. Keep non-sensitive parameters separate from credentials and ensure debug, verbose, error, and JSON-output paths never print authorization headers, secrets, or complete signed requests.
  6. Update SKILL.md so examples no longer pass credentials through command-line options.
  7. Add centralized credential loading and validation shared by all scripts.
  8. Add and validate the missing movecard configuration in config_manager.py, alarm_query.py, and stats_query.py through the protected configuration mechanism rather than another sensitive command argument.
  9. Restrict credential scope and lifetime where supported, and rotate application secrets and authorization tokens that may previously have been exposed through process arguments or logs.
  10. Add automated tests that verify secrets do not appear in process arguments, normal output, verbose output, exception messages, or logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述强调的是老人居家安全与健康的全天候守护、家属实时掌握老人状态、远程看护等完整看护能力；但提供的代码仅实现两个接口调用：查询异常提醒配置列表和更新异常提醒配置。它没有进行任何实时监测、告警推送、状态汇总、家属查看、健康分析或远程看护逻辑。虽然“异常提醒配置”与老人看护场景相关，但该代码的实际主功能是后台配置管理，而不是描述中的看护服务本身，因此存在实质性描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

描述将该技能表述为面向老人居家看护的完整监护能力，强调全天候守护、实时掌握老人状态和远程看护效果。但代码只访问两个API端点：一个查询 aiAnalysisSwitch 状态，另一个修改该开关；本质上是服务套餐/功能开关管理工具。它没有读取传感器、视频、健康数据、告警事件，也没有向家属提供老人状态信息。因此其实际主功能明显比声明更窄，且包含一个未明确声明的配置变更能力（开启/关闭服务）。这属于描述与行为的实质性不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述聚焦于老人看护、健康/安全监测和远程状态掌握，但提供的代码不包含任何与老人监护、传感器数据、告警、状态查询、消息通知或家庭看护相关的逻辑。相反，代码完全是一个底层签名与时间戳生成工具，用于开放平台接口调用时的鉴权辅助。这属于与声明主用途 materially different 的行为，应判定为描述与实际代码明显不匹配。

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

md
| `SKILL.md` | 技能文档 |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation exposes capabilities that imply shell execution and outbound network access, but it does not declare any tool scope or allowed-tools constraints. In an agent environment, missing capability boundaries increases the risk of over-privileged execution, accidental misuse of credentials, and unreviewed access to external endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill handles highly sensitive elder-care data, including fall alarms, behavior alerts, daily routines, diet records, device identifiers, and authentication tokens, yet it provides no privacy warning or guidance on sensitive-data handling. In this context, exposure of such data can reveal intimate health, presence, and behavioral patterns of a vulnerable population, making the omission more serious than generic telemetry handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The examples instruct users to export secrets and bearer tokens directly into shell environment variables without warning about credential leakage through shell history, process inspection, shared sessions, debugging output, or accidental logging. Because these credentials grant access to elderly-monitoring APIs and sensitive records, compromise could enable unauthorized data access or configuration changes such as disabling monitoring-related services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code requires sensitive values such as uuid, appkey, secret, and auth token, then sends them in HTTP headers along with user and device identifiers to a remote API. Although the script purpose is querying alarms, there is no confirmation prompt, visible disclosure, or warning to the user that credentials and potentially sensitive monitoring data will be transmitted off-host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The inline help for --verbose says it will output a detailed curl command and the raw API response, implying an implemented diagnostic mode. However, args.verbose is never referenced anywhere after parsing, so enabling this flag has no effect and the documented behavior is contradicted by the actual code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The top-level documentation presents this as an '异常配置管理脚本 - 查询和更新异常提醒设置', but within the elderly-care skill context this file includes a direct state-changing capability via the update API, allowing remote reconfiguration of monitoring behavior. A caregiver-monitoring skill description focuses on safeguarding and status visibility; remotely changing alert thresholds and enablement is a stronger operational capability than passive status access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest describes helping family members understand an elder's status and perform remote caregiving, but this function can enable/disable alerts and alter behavior thresholds and monitoring windows through the platform API. That administrative control over detection policy is not clearly justified by the stated purpose centered on observation and safety awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The update path can change live elderly-care alert settings immediately with no interactive confirmation, dry-run mode, or extra safeguard. In this skill context, accidental disabling or weakening of alerts could reduce monitoring coverage for vulnerable users and delay detection of prolonged sitting, lying down, or absence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code requires sensitive values such as uuid, appKey, secret, authorization token, and user/device identifiers, then sends them in HTTP headers and request bodies to a remote API. Although the script's purpose involves querying and changing a remote service, it does not clearly warn users that these credentials and identifiers will be transmitted to an external endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code requires sensitive inputs including device serial number, user ID, uuid, appkey, secret, and auth token, then uses them in authenticated HTTP requests to an external service. While the script purpose is querying remote stats, there is no explicit disclosure in user-facing help or output that these identifiers and credentials will be transmitted off-host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring, argument descriptions, errors, and formatted results are all hard-coded in Chinese, with no option for users to select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The docstring, CLI descriptions, and user-facing output are written exclusively in Chinese, which imposes a language choice on users without opt-in or documented locale justification. Under the stated policy, fixed language/locale behavior should either offer a choice or clearly document that the tool is intended only for a specific locale or audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Argument descriptions and status/error messages are all emitted in Chinese, and the script provides no option to select another language. This is a natural-language policy issue because the tool fixes a locale-specific user experience without offering choice or explicit justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing natural language in the module docstring, CLI help text, and status/error messages is in Chinese, with no opt-in or alternative locale. This can violate language/locale policy when skills are expected to avoid forcing a specific language absent user choice or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level docstring is entirely in Chinese, and the rest of the user-facing comments and docstrings in the file continue that single-language assumption. Under the policy, language-specific behavior or instructions should not be forced without user opt-in or a documented justification for the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's docstring, argument descriptions, errors, and formatted output are written in Chinese throughout, which effectively forces a specific language for all users. There is no opt-in, locale selection, or documented reason that the tool must be Chinese-only.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

--verbose 参数的帮助文本写明会输出“详细 curl 命令和原始响应”，且称“重要查询必须使用”，这会让使用者认为脚本具备额外的调试/审计输出能力。但后续代码从未读取 args.verbose，也没有打印 curl 命令或原始响应，文档说明与实际行为直接不符。

Content

No source excerpt is available for this finding.