ClawHub
Back to skill

Security audit

jf-open-pro-capture

Security checks across malware telemetry and agentic risk

Overview

This camera-capture skill matches its stated purpose, but it handles sensitive device credentials and images with weak endpoint and download scoping.

Review before installing. Use only trusted JF API endpoints, keep app secrets and device tokens out of shared environments, avoid broad device-list files unless needed, and save downloaded images only to restricted locations with a deletion plan.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tainted flow: 'url' from os.getenv (line 92, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"accessToken": access_token
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
94% confidence
Finding
The request URL is built from the JF_ENDPOINT environment variable and then used for authenticated POST requests carrying headers with uuid, appKey, timeMillis, and signature. If an attacker can influence that environment variable, the script will send signed device-management requests and associated metadata to an attacker-controlled host, creating an SSRF/exfiltration channel for sensitive operational data.

Tainted flow: 'url' from os.getenv (line 92, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
94% confidence
Finding
This capture request also uses a URL derived from the attacker-influenceable JF_ENDPOINT environment variable, but here it triggers image capture operations using signed headers and a device token in the path. A malicious endpoint could receive sensitive request metadata and device tokens, or coerce the tool into interacting with unintended infrastructure.

Tainted flow: 'image_url' from requests.post (line 273, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
是否成功
    """
    try:
        resp = requests.get(image_url, timeout=30)
        if resp.status_code == 200:
            with open(output_path, 'wb') as f:
                f.write(resp.content)
Confidence
90% confidence
Finding
The script downloads image_url returned by the remote API without validating the destination host, scheme, or IP range. If the upstream API is compromised or an attacker can influence its response, this becomes an SSRF primitive that can make the agent fetch internal services or arbitrary external content and save it locally.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation clearly indicates use of environment variables, file input, and outbound network access, yet no permissions are declared. This creates a transparency and policy-enforcement gap: users or the hosting platform may not realize the skill can read secrets, ingest local files, and contact remote endpoints, which increases the risk of unintended data exposure or over-privileged execution.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill supports downloading captured device images to local storage but does not warn that these images may contain sensitive visual data such as homes, offices, people, or security camera scenes. Without explicit privacy and retention guidance, users may save images insecurely, keep them longer than intended, or store them in shared locations, increasing the chance of privacy leakage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.