Security audit

jf-open-pro-ai-smart-search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real JF Tech cloud video search/playback tool, but it needs Review because signed requests and sensitive video access details can be sent beyond the declared API scope and exposed in output logs.

Install only if you are authorized to access the JF Tech account and camera footage, can keep the environment variables private, and can control logs/transcripts that may capture playback URLs. Treat playback URLs like temporary secrets. Do not set JF_ENDPOINT unless it is restricted to an approved JF Tech API host; ideally the publisher should add strict endpoint allowlisting and redact sensitive output before broad use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/get_playback_url.py:91
Finding: Unrestricted API Endpoint Allows Redirection of Signed Requests and Device Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/get_playback_url.py:319
Finding: Playback URLs, Device Identifiers, and API Results Are Exposed Through Standard Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This duplicate mismatch finding points to the same underlying issue: the documented purpose understates that the skill can fetch direct playback/download URLs and bypass semantic search by using explicit start/stop times. In the context of cloud-stored alarm videos, that expands access from discovery to direct surveillance content retrieval, which raises privacy and misuse risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This duplicate mismatch finding points to the same underlying issue: the documented purpose understates that the skill can fetch direct playback/download URLs and bypass semantic search by using explicit start/stop times. In the context of cloud-stored alarm videos, that expands access from discovery to direct surveillance content retrieval, which raises privacy and misuse risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises security properties and network restrictions, but it does not declare an explicit tool scope such as allowed-tools or permissions despite requiring environment variables, network access, and shell execution of Python scripts. In an agent platform, this can cause the runtime to grant broader capabilities than intended or make enforcement ambiguous, increasing the chance of credential exposure or unintended command/network use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill handles privacy-sensitive surveillance video search and playback, yet the documentation does not provide a clear warning about lawful use, consent, retention, or the sensitivity of retrieved footage and playback links. In this context, weak privacy signaling can lead to inappropriate deployment, overbroad sharing of footage URLs, or use on subjects without proper authorization.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/jftech-api.md (reported line 57)May include surrounding context.
请求示例：

bash
curl -X POST "https://api.jftechws.com/aisvr/v3/gateway/api/viewsearch/searchVideo" \ -H "Content-Type: application/json" \ -H "uuid: your-uuid" \ -H "appkey: your-appkey" \

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file lists activation/search phrases such as "人", "有人", and "人出现" as valid queries without clarifying scope or exclusions. These terms are extremely generic and could match common speech or produce unintended invocations/results because the document does not define when they should or should not be used.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Queries like "车" and "车辆经过" are broad, generic phrases presented as examples with no limitation on context, platform behavior, or disambiguation guidance. In a trigger/reference document, this lack of specificity can lead to unintended or overly broad activation/results.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation shows command lines containing credential parameters such as appkey, secret, and auth token, but does not warn users not to paste real secrets into shared terminals, logs, shell history, screenshots, or source-controlled docs. In a security-sensitive video platform context, exposing these values could allow unauthorized search or playback access to surveillance footage and associated metadata.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script’s documented workflow explicitly expands from semantic search into cloud-storage playback retrieval for selected footage. That broadens the capability from metadata search to direct access to video content, increasing privacy and surveillance risk if the skill is invoked in contexts where users expect only search results rather than footage access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code not only retrieves playback URLs but also instructs the user how to open them in VLC, a browser, or download them with curl. This turns a search utility into a content-access and extraction tool, which can facilitate bulk viewing or exfiltration of surveillance footage beyond the minimally stated smart-search purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script reads device identifiers and API credentials from environment variables and then uses them to call external APIs, but it provides no explicit disclosure at runtime that these identifiers will be transmitted off-host. In security-sensitive environments, lack of notice and consent around network disclosure of surveillance-related identifiers can lead to unintended data exposure or misuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill metadata describes semantic search, but the script also obtains device tokens and generates direct playback/download URLs for matched cloud alarm videos. This expands the capability from search to retrieval of potentially sensitive surveillance content, increasing the risk of unauthorized access, privacy violations, and misuse if the skill is invoked in contexts expecting search-only behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/jftech-api.md (reported line 9)May include surrounding context.
md
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/jftech-api.md (reported line 44)May include surrounding context.
md
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/jftech-api.md (reported line 57)May include surrounding context.
md
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ai_search_playback.py (reported line 41)May include surrounding context.
python
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_playback_url.py (reported line 15)May include surrounding context.
python
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_playback_url.py (reported line 16)May include surrounding context.
python
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_playback_url.py (reported line 75)May include surrounding context.
python
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/search_video.py (reported line 65)May include surrounding context.
python
https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672 API 端点： 1. 获取设备 Token: POST https://api.jftechws.com/gwp/v3/rtc/device/token 2. 云存回放：POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 用法：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 76% confidence
Finding: This function sends surveillance metadata and requests a playback URL for cloud alarm footage to a remote API, and the endpoint is user-configurable via the JF_ENDPOINT environment variable. If that variable is manipulated, credentials-bearing requests and sensitive video-access parameters could be redirected to an attacker-controlled host, causing secret leakage and unauthorized disclosure of surveillance access URLs.
Content: Scanner excerpt · scripts/get_playback_url.py (reported line 126)May include surrounding context.
python
根据录像开始时间（st 对应 startTime）和录像结束时间（et 对应 stopTime）获取对应云存报警视频播放链接 API: POST https://api.jftechws.com/gwp/v3/rtc/device/getVideoUrl/{deviceToken} 官方文档： https://docs.jftech.com/docs?menusId=54582398fd8d4248962354e92ac2e47a&siderId=2e08468f46564602d01ae8a244661672

External Transmission

Medium

Category: Data Exfiltration
Confidence: 74% confidence
Finding: The AI search function transmits device identifiers, user identifiers, search terms, and authentication headers to a remote endpoint whose host is configurable. In a surveillance-search context, this can expose sensitive operational metadata and credentials if endpoint configuration is abused or if the broader skill is assumed to be local-only search.
Content: Scanner excerpt · scripts/get_playback_url.py (reported line 190)May include surrounding context.
python
""" AI 智搜 - 搜索云存报警视频 API: POST https://api.jftechws.com/aisvr/v3/gateway/api/viewsearch/searchVideo Args: sn: 设备序列号

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This manifest file is in scope for vague-trigger review. The description says the skill searches by semantic content using examples like "带帽子的人", "车", and "狗", but it does not define when the skill should be invoked, what exact phrases trigger it, or any negative examples to prevent accidental activation from ordinary conversation about people, cars, or dogs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: A file-wide natural-language policy concern exists because the content forces a specific language presentation with no opt-in or alternative language guidance. The stated policy says language or locale constraints should not be imposed unless the skill offers a choice or clearly documents a justified regional restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file documents API calls that require authorization, uuid, appkey, device serial number, and user ID, and includes a concrete POST example to a remote endpoint. Under the markdown-specific warning rule, the document should disclose the privacy/security impact of sending these identifiers and tokens to the vendor API, but no such warning is present.
Content: No source excerpt is available for this finding.