jf-open-pro-ai-joblover

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.1

Overview

This appears to be a real JFTech patrol API helper, but it needs review because it handles employee-monitoring data and credentials unsafely and can change monitoring settings without safeguards.

Install only if you are authorized to manage this JFTech employee-monitoring deployment. Do not run verbose mode with real credentials, avoid passing secrets directly on the command line, confirm the intended regional endpoint before any API use, and require human approval before disabling the service or deleting patrol plans.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/alarm_query.py:131

Finding

API Secrets and Authorization Tokens Exposed Through Command-Line Arguments

Content

View full analysis

" \ --user "" \ --uuid "" \ --appkey "" \ --secret "" \ --auth "" \ --movecard 7 ``` ### Technical Analysis The scripts require the application secret and authorization token to be passed as command-line arguments, even though `SKILL.md` separately defines protected environment variables such as `JF_APP_SECRET` and `JF_AUTHORIZATION`. Command-line secrets may be exposed through: - Process inspection facilities such as `/proc/<pid>/cmdline` or process-monitoring tools. - Shell command history. - Job runners, CI systems, terminal recording, and process telemetry. - Agent execution transcripts and diagnostic logs that record invoked commands. The application secret participates in request signing, while the authorization value authenticates API requests. Their exposure is not necessary for the declared functionality because they can be read from a secret manager or protected environment without appearing in process arguments. ...[truncated 1116 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/inspection.py:67

Finding

Verbose Mode Prints a Reusable Authenticated Curl Command

Content

View full analysis

Remediation

View remediation

` - `signature: ` - `appKey: ` 3. Mask identifiers where full values are unnecessary, including UUIDs, user IDs, and device serial numbers. 4. Replace the executable curl output with a sanitized request summary containing only the HTTP method, validated hostname, endpoint path, and body-field names. 5. Keep raw API responses disabled by default and redact sensitive response fields before verbose output. 6. Add automated tests asserting that known secret values never appear in normal, JSON, verbose, or error output. 7. Review and purge existing logs or transcripts that may contain credentials, then rotate exposed tokens and application secrets. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/inspection.py:52

Finding

Configured Regional Endpoint Is Ignored in Favor of a Hardcoded China Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个较完整的岗位巡检系统能力集合，核心包括实时监控、事件通知、异常检测和行为统计。但提供的代码片段只包含 alarm_query.py，其功能是生成签名后向 https://api-cn.jftechws.com/aisvr/v3/gateway/api/child/alarm/page 发送 POST 请求，查询异常告警分页列表，并将结果显示出来。这属于“查询已有告警数据”的只读检索能力。代码没有实现持续监听/实时监控逻辑，没有消息推送机制，没有本地或服务端行为识别检测逻辑，也没有统计汇总处理。因此，代码实际行为与声明的主要用途相比明显缩窄且不同，应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

代码的核心功能是一个命令行管理脚本，用于调用 /switch/get 和 /switch/change 两个接口，查询或设置岗位巡检分析服务是否开启。它需要设备序列号、用户 ID、uuid、appKey、secret、Authorization 等参数，生成签名后直接请求远程 API，并格式化返回结果。声明描述则强调业务层面的巡检能力本身（监控、通知、检测、统计），但这段代码并没有执行这些巡检分析任务，只是在管理该服务的开关状态。因此代码实际行为与声明的主要用途存在明显偏差，属于功能性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是安防/考勤/巡检类业务能力，需要涉及人员状态监控、通知推送、异常行为检测、数据记录统计等。提供的代码并未实现任何监控、通知、检测、统计或岗位巡检逻辑，也没有访问摄像头、员工状态、消息推送或存储相关资源。相反，它是一个独立的签名生成辅助模块，用于开放平台接口鉴权。这属于与声明主用途 materially different 的行为，应判定为描述与代码不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个运行中的巡检/监控类技能，强调实时监控员工在岗状态、推送到岗离岗通知、异常行为检测以及行为数据记录统计。但代码并没有实现任何实时监控、事件通知、异常检测或数据统计逻辑。它的核心功能仅是管理巡检计划配置：向 /joblover/plan/add、/remove、/list 接口发送请求以新增、删除、查询值岗计划。虽然这些计划管理操作与“岗位巡检”领域相关，但它们属于配置管理而非描述中宣称的主要行为，因此存在明显的描述—行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

声明描述的是一个较完整的岗位巡检技能，重点在“实时监控、通知推送、异常检测、统计分析”。但提供的代码块实际只做统计数据查询，调用的是 queryCount、queryTime、queryTimeForDayChart、queryCountForWeekChart 等接口，属于读取已有统计结果的客户端脚本。代码中没有任何持续监控逻辑、事件订阅、消息推送、告警机制，也没有本地视频/行为识别检测能力。因此，虽然“记录并统计行为数据”与代码部分相关，但整体描述明显高于代码实际能力，主功能存在实质性不一致。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.

md

| `SKILL.md` | 技能文档 |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents shell commands and external API calls but does not declare any explicit tool scope or allowed-tools policy. This creates a governance gap where an agent may be permitted to use network and shell capabilities more broadly than the skill metadata communicates, increasing the chance of unintended command execution or outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill centers on employee surveillance, abnormal-behavior detection, and behavior-data recording, yet it does not present any explicit privacy, consent, retention, or lawful-use warning. In this context, missing privacy guardrails materially increases the risk of misuse, unlawful monitoring, and collection of sensitive personnel data without appropriate notice or authorization.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The file includes debug examples that generate signatures and send authenticated requests with sensitive headers such as app identifiers and authorization tokens to external endpoints. Even though placeholders are shown, this normalizes handling secrets directly in shell history and debug workflows, increasing the chance of accidental credential exposure or transmission to the wrong endpoint.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

--movecard 7

text

### 1.1 完整 curl 示例（用于调试）

```bash
# 生成签名（使用 jf_signature.py）

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation gives ready-to-run examples for enabling/disabling inspection and deleting duty plans without warning about operational consequences. An operator or agent could unintentionally disable monitoring coverage or remove schedules, causing loss of detection, audit gaps, or interruption of safety-critical oversight.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs an HTTP POST to an external API and includes potentially sensitive data such as device serial number, user ID, UUID, and an Authorization token in the request headers/body. While the script's purpose is to query alarms, there is no explicit runtime warning, confirmation, or user-facing disclosure that these identifiers and credentials will be transmitted to a remote service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says the skill performs real-time employee on-duty monitoring, departure notifications, abnormal behavior detection, and behavior data recording/statistics. In contrast, this file only implements two control-plane operations against remote APIs: reading the service switch status and enabling/disabling that switch. That is a substantive mismatch between the claimed operational capability and the actual code in this skill file.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/inspection.py (reported line 16)May include surrounding context.

python

重要：
    - 所有查询直接使用 API，不使用缓存
    - 输出包含完整 curl 命令和原始响应
    - 以实际 API 响应为准，不编造解释
"""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Verbose mode prints a full curl command containing the Authorization token, app identifiers, signature, and timing data directly to stdout. In agent, CI, shared-terminal, or log-collected environments, these secrets can be captured from logs or transcripts and reused to access or manipulate the remote service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script includes add and delete capabilities for duty/patrol plans, which go beyond the skill’s stated monitoring and notification scope. This mismatch increases the risk of unauthorized operational changes because a user or downstream agent may invoke schedule-modifying functionality that is not expected from the manifest, potentially disabling or altering patrol coverage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The delete path performs an irreversible remote action immediately when provided an ID, without any confirmation, dry-run option, or secondary safeguard. In an agent context, this makes accidental, coerced, or prompt-induced deletion of patrol plans more likely, which can disrupt monitoring coverage and weaken physical security operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script accepts sensitive values such as app secrets and authorization tokens directly via command-line arguments. On many systems these values can be exposed to other local users through process listings, shell history, audit logs, or job schedulers, which can lead to credential theft and unauthorized access to the JF Tech API.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Natural-language policy issues apply to all file types, and this skill appears to require Chinese comprehension throughout its description, prerequisites, and examples. There is no indication that language choice is optional or that the Chinese-only presentation is a documented, justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language documentation, argument help text, and output strings are all in Chinese, which effectively forces a specific language experience. There is no indication that this is a region-specific tool or that users can opt into another language, so it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Natural-language strings in the module docstring and command-line help are written exclusively in Chinese, with no opt-in or alternative locale. This can violate language/locale policy where tools should not force a specific language on users without documented justification or choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The command-line interface exposes an --endpoint argument, implying requests will honor a caller-specified API endpoint. However, both request functions use fixed https://api-cn.jftechws.com URLs and never read args.endpoint, so the documented/runtime intent diverges from actual behavior. This is more than incomplete documentation because the interface actively advertises configurability that does not exist.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file’s natural-language documentation is written entirely in Chinese, including the module docstring and function descriptions. Under the stated policy, a forced language choice without user opt-in or a documented locale-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and command help/output strings are written only in Chinese, which imposes a specific language/locale without any opt-in or alternative. The policy requires avoiding forced language constraints unless the tool explicitly offers a language choice or clearly justifies the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language instructions, usage, and help context are presented only in Chinese, which effectively forces a specific language for users without indicating that this is a region-specific or opt-in constraint. Under the stated policy, language restrictions should be either optional for the user or clearly justified.

Content

No source excerpt is available for this finding.