ClawHub
Back to skill

Security audit

jf-open-pro-device-battery-manage

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its device battery-management purpose, but it handles device credentials and can change device settings while allowing an unrestricted API endpoint and printing sensitive tokens.

Review before installing. Use it only in a controlled environment, set JF_ENDPOINT only to a documented JFTech host, avoid logging terminal output when retrieving tokens, and confirm the exact device and threshold before running any set-threshold action.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tainted flow: 'url' from os.getenv (line 119, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Name": "Ability.AovAbility"
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
The request URL is built from JF_ENDPOINT, which is taken directly from an environment variable and then used for authenticated outbound requests. If an attacker can influence the environment, the script will send signed requests and sensitive headers (uuid, appKey, signature, timestamp, request ID) plus device metadata to an arbitrary host, creating an SSRF/exfiltration path.

Tainted flow: 'url' from os.getenv (line 119, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Name": "Dev.LowElectrMode"
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
This call uses the same environment-controlled JF_ENDPOINT to construct the destination for a signed API request. A manipulated endpoint can redirect authentication material and device-related requests to an attacker-controlled server, exposing secrets and enabling replay or unauthorized API interaction depending on how signatures are used.

Tainted flow: 'url' from os.getenv (line 119, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
97% confidence
Finding
The set-threshold operation sends authenticated state-changing requests to a URL derived from an untrusted environment variable. If redirected to an attacker-controlled endpoint, it can leak credentials/signatures and operational details, and because this function performs configuration changes, it increases the risk of unauthorized or misleading device-management interactions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly relies on environment variables containing sensitive credentials and on outbound network access, yet the manifest does not declare these capabilities. This weakens reviewability and informed consent because a user or platform may not realize the skill can read secrets and make authenticated API calls to external services.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases include broad terms such as '低电量模式', '电池管理', and '电量配置', which may match generic user requests beyond this specific vendor/device context. Over-broad activation can cause unintended invocation of a skill that reads credentials and performs remote configuration changes on devices.

Vague Triggers

Medium
Confidence
78% confidence
Finding
Repeating ambiguous invocation wording in the README reinforces the risk of accidental or overly broad activation. Because this skill can ultimately change device configuration, unclear activation boundaries increase the chance of unintended configuration changes or misuse in unrelated battery-related conversations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script prints the full device token to stdout, which can expose a sensitive credential to terminal history, logs, CI output, shell capture, or other users on the same system. If the token grants device or RTC access, an attacker who obtains it may impersonate the device session or access associated functionality.

Static analysis

No suspicious patterns detected.