T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/device_auth.py:82- Finding
Sensitive credentials exposed through command-line arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
jf-open-pro-ai-outdoor
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate JF Tech outdoor security helper, but it can change live security-device settings and handles sensitive credentials in ways users should review carefully.
Install only if you intend to let the skill manage JF Tech outdoor security devices. Prefer environment variables or a secret manager over command-line secrets, manually confirm every delete/update/disable/credential-sync action, and be aware that identifiers, alarm data, uploaded images, and device credentials may be sent to the JF Tech API endpoint used by the scripts. Rotate any credentials already used in command-line examples or captured in logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding points to a materially different behavior: device credential synchronization/authentication that may collect and upload device login credentials, which is much more sensitive than ordinary alarm/configuration operations. If the skill causes users to supply credentials under a broad 'security monitoring' label, it risks secret exfiltration, overcollection, and misuse of high-value device access.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | 技能文档 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scripts/push_plan.py` | 通知计划管理脚本 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documentation describes use of environment variables, shell commands, and outbound API access, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates a trust-boundary problem: an agent may invoke shell, read secrets from the environment, and make network calls without a clear least-privilege contract, increasing the chance of unintended credential exposure or unsafe execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad and generic for a high-impact skill that can modify settings, delete records, and sync credentials. Overbroad activation increases the risk that an agent invokes the skill in contexts where the user intended only informational assistance, causing unintended state changes or access to sensitive device data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation includes destructive and sensitive operations such as add/update/delete and device credential synchronization, but it lacks clear user warnings or mandatory confirmation language. In a security-device context, silent execution of these operations can disable protections, alter monitoring behavior, remove records, or expose device access material.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code reads sensitive values from environment variables and CLI arguments, including app secrets and authorization tokens, then uses them to make a network request. While the script has functional print statements, it does not disclose to the user that credentials and device/user identifiers will be sent to a remote API or provide any caution about handling sensitive authentication data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code parses user-supplied area data and immediately sends an update request that changes the device's detection region. Although the script name and help text indicate it sets an area, there is no confirmation prompt or explicit warning near execution that the operation will modify live device configuration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script exposes a vehicle deletion action that issues a remote DELETE-equivalent API call, but there is no confirmation prompt or warning before the operation runs. Although the function has a brief docstring, the user-facing flow does not disclose that the action is destructive or irreversible before invoking it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The
preview_platefunction sends Base64-encoded image data to a remote API endpoint for plate recognition. While the code has a functional docstring, the CLI does not clearly warn users that potentially sensitive image content will be transmitted to an external service.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file contains natural-language guidance, usage text, and help content only in Chinese, which can amount to forcing a specific language on users without explicit opt-in. The policy allows locale constraints when they are clearly documented and justified as region-specific, but this file does not state such a limitation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code performs a state-changing remote save via the
/pushConfig/saveAPI, which can alter device notification behavior, but there is no confirmation prompt or explicit warning before applying the change. Although the script prints the action type, it does not clearly disclose that the save action will modify remote configuration prior to execution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code issues a delete request for notification plans, which is a destructive operation, but there is no confirmation prompt or specific user-facing warning immediately before execution. Although the file docstring lists delete as a feature, the runtime flow does not disclose the destructive impact when the delete action is actually invoked.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python return make_request(url, data, headers) def delete_push_plan(plan_id, sn=None, user=None, uuid=None, appkey=None, secret=None, movecard=None, auth=None): """删除通知计划""" time_millis, signature = generate_signature(uuid, appkey, secret, movecard)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings throughout the file, including the module docstring, CLI help text, and runtime messages, are exclusively in Chinese. This forces a specific language experience without giving users an option to select their preferred language or documenting a justified locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
For the
setaction, the code validates the numeric range and then directly calls the remotesetSensitivityAPI. Although the script prints the operation type, it does not clearly warn the user that this will modify device configuration or ask for confirmation before making the change.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script supports an
updateaction that enables or disables smart detection features on a device by sending a POST request to the remote update API. Although the action is described functionally, there is no explicit user warning or confirmation that this will modify live device configuration, which is a safety-relevant operation affecting system behavior.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file performs outbound HTTP POST requests carrying sensitive fields including device serial number, user ID, uuid, appKey, signature, and Authorization token to an external service. Although the script's purpose is querying stats, the runtime path provides no confirmation prompt or visible disclosure that these identifiers and credentials will be sent over the network.
- Content