Security audit

jf-open-pro-ai-smart-search

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for JF Tech video search, but it also exposes direct surveillance playback URLs with broad time-range access and some weak scoping/documentation.

Install only if you intend to let the agent query JF Tech cloud alarm footage and generate direct playback or download URLs. Use least-privilege JF credentials, keep credentials in environment variables rather than command lines, avoid setting JF_ENDPOINT to non-JF hosts, and treat printed playback URLs as sensitive surveillance data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill is presented primarily as a semantic video search tool, but the documentation also describes token generation and direct retrieval of playback URLs for arbitrary time ranges. That broader capability increases access to surveillance footage beyond simple search results, which can surprise users, weaken least-privilege expectations, and enable misuse if integrated into larger agent workflows without clear disclosure.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script’s documented workflow goes beyond semantic search and retrieves cloud playback URLs that can be opened in a browser, VLC, or downloaded with curl. In a skill described as smart search, this materially expands the capability from metadata lookup to direct access to recorded video content, increasing the chance of unauthorized surveillance data exposure if the skill is invoked in a broader agent context.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This code obtains device playback tokens and then exchanges them for direct video URLs, which grants access to cloud-stored footage rather than merely returning search matches. If exposed through an agent skill without strong authorization controls, an attacker or over-permissioned workflow could use it to access or exfiltrate sensitive surveillance recordings.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill’s stated purpose is semantic video search, but this script also turns search results into direct playback/download URLs for cloud-stored alarm footage. That expands the capability from metadata retrieval into direct content access, which increases privacy and misuse risk if the skill is invoked by an agent without strong authorization checks or user awareness.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The direct --start-time/--stop-time mode bypasses the semantic-search workflow and allows retrieval of playback URLs for arbitrary time ranges. In the context of a smart-search skill, this broadens access in a way that could enable bulk or targeted review of surveillance footage unrelated to the user’s original query.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation includes command examples with credential-bearing parameters such as app keys, secrets, and auth tokens directly on the command line. Even with placeholders, this pattern encourages unsafe operational practice because shell history, process lists, logs, screenshots, and copied commands can expose secrets to other users or systems.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The script sends device identifiers, user identifiers, search terms, and signed authentication material to a third-party API endpoint, but provides no explicit disclosure or consent checkpoint about that network transmission. In an agent setting, users may believe they are performing a local search while actually disclosing surveillance-related data externally, creating privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script sends device serial numbers, user identifiers, search terms, and signed API authentication data to external services, but it provides no explicit privacy notice, consent step, or minimization controls. In a surveillance context, these values can reveal sensitive information about users, devices, and monitored content, making silent transmission materially risky.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The description advertises very broad semantic triggering such as 'person with a hat', 'car', and 'dog' without defining explicit activation boundaries, authorization checks, or data-scope constraints. In a video-search skill tied to cloud alarm footage, this can enable overbroad retrieval of surveillance content, increasing the risk of privacy misuse, inappropriate invocation, or excessive data exposure if upstream controls are weak.

Static analysis

No suspicious patterns detected.