ClawHub
Back to skill

Security audit

jf-open-pro-device-human-detection

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to manage JF camera human detection, but it should be reviewed because it can change surveillance and PTZ tracking settings while sending signed device requests to an environment-configured host.

Install only if you operate the affected JF cameras and are authorized to enable human detection or auto-tracking. Keep JF_ENDPOINT set to a documented JF regional API host, do not expose these credentials broadly to agents, and consider whether local privacy, consent, and camera-motion policies allow these features.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
92% confidence
Finding
The request target is derived from the JF_ENDPOINT environment variable and is used to build the HTTPS URL for authenticated API calls. Because the code sends uuid, appKey, timestamp, and signature headers to whatever host is configured, a malicious or compromised environment can redirect sensitive device-management traffic to an attacker-controlled endpoint, enabling SSRF-style outbound access and credential/signature exfiltration.

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Detect.HumanDetection": config
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
92% confidence
Finding
This configuration-setting call also uses a URL built from the attacker-influenced JF_ENDPOINT environment variable. That makes it possible to exfiltrate signed control requests and device tokens to an untrusted server and potentially trigger unauthorized state changes against devices if the attacker can influence runtime configuration.

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
92% confidence
Finding
The human-tracking configuration fetch sends authenticated metadata to a host chosen via environment variable input. In a skill context, where execution environments and injected environment variables may be less trusted, this increases the risk of outbound requests to attacker infrastructure and leakage of device-management secrets.

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Detect.DetectTrack": config
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
92% confidence
Finding
The tracking-configuration update path performs a signed POST to a URL derived from JF_ENDPOINT, so a manipulated environment can redirect sensitive control traffic externally. Because this path changes device behavior, the risk includes both secret leakage and abuse of administrative actions routed through attacker-controlled infrastructure.

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill documentation describes use of environment variables containing secrets and outbound API calls, but it does not declare corresponding permissions. This creates a transparency and governance gap: users or platforms may not realize the skill can read credentials and send device-control requests over the network, increasing the risk of over-privileged deployment and misuse if the skill is installed in a broader agent environment.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This skill enables and configures human detection and auto-tracking on cameras, which can materially affect privacy and device behavior, yet the documentation does not prominently warn about surveillance, consent, or operational impact. In this context, omission matters because the feature changes how people are monitored and how a PTZ device moves, so operators may enable tracking without understanding privacy obligations or physical/system side effects.

Static analysis

No suspicious patterns detected.