ClawHub
Back to skill

Security audit

jf-open-pro-cloud-record

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for JFTech cloud video access, but it handles sensitive camera recordings with an unrestricted API endpoint override and exposes playback/download URLs in console output.

Review this before installing if you use it with real cameras. Only set JF_ENDPOINT to a trusted JFTech regional host, treat JF_APP_SECRET and JF_DEVICE_TOKEN as sensitive credentials, and avoid running playback or download commands where console output is logged or visible to others.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tainted flow: 'url' from os.getenv (line 131, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if events:
        body["events"] = events
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
The request destination is derived from JF_ENDPOINT, which can be overridden at runtime via an environment variable. That allows an attacker or misconfigured runtime to redirect authenticated requests, including signed headers, device token usage, and surveillance metadata, to an arbitrary host, creating an SSRF/exfiltration path.

Tainted flow: 'url' from os.getenv (line 131, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if multi_video:
        body["multiVideo"] = "1"
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
This POST request uses a URL built from an environment-controlled endpoint, so the skill can be induced to send authenticated cloud-record requests to an attacker-controlled server. In this code path, the risk is amplified because the response may contain playback or download links for sensitive recordings, and the request includes credentials-derived signing material.

Tainted flow: 'url' from os.getenv (line 131, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if alarm_event:
        body["alarmEvent"] = alarm_event
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
Alarm-query requests are sent to a URL whose host is indirectly controlled by an environment variable. This enables unauthorized transmission of surveillance event metadata and signed request headers to an arbitrary external server if the environment is tampered with or misconfigured.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation requires environment secrets and makes network API calls, but the skill does not declare corresponding permissions. This creates a transparency and governance gap: operators may not understand that the skill reads sensitive credentials and accesses external cloud endpoints, making misuse, over-privileged execution, or unsafe deployment more likely.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Allowing the remote API host to be changed at runtime expands the skill beyond its stated narrow integration and undermines trust boundaries. In this surveillance context, that flexibility makes it materially easier to exfiltrate device metadata and authenticated requests to unintended destinations.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation explicitly supports obtaining downloadable cloud video URLs and states they remain valid for 24 hours, but it does not warn that recorded footage is highly privacy-sensitive. In the context of surveillance/cloud recordings, exportable URLs can expose intimate household or business activity if copied, logged, shared, or retrieved by unauthorized users.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill retrieves and prints cloud playback/download URLs for surveillance recordings directly to stdout. In many agent or shared-shell environments, stdout is logged or visible to other users, so this can unintentionally disclose time-limited access links to sensitive video content.

Static analysis

No suspicious patterns detected.