jf-open-pro-device-human-detection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.1

Overview

This skill appears purpose-aligned for managing JFTech human-detection settings, but it sends sensitive signed device requests to an environment-selected endpoint without restricting it to official hosts.

Install only if you trust the publisher and can control the runtime environment. Keep JF_ENDPOINT unset or set only to an official JFTech regional host, protect JF_APP_SECRET and JF_DEVICE_TOKEN, and treat the set actions as real changes to a security device's detection and tracking behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/human_detection.py:24

Finding

Unrestricted API Endpoint Allows Disclosure of Device Authentication Material

Content

View full analysis

Dict[str, str]: time_millis = get_time_millis() signature = generate_signature(uuid, app_key, app_secret, time_millis, move_card) return { "Content-Type": "application/json; charset=UTF-8", "uuid": uuid, "appKey": app_key, "timeMillis": time_millis, "signature": signature, "X-Request-Id": os.urandom(16).hex() } url = f"{JF_BASE_URL}/rtc/device/getconfig/{device_token}" headers = get_headers(uuid, app_key, app_secret, move_card) response = requests.post(url, headers=headers, json=body, timeout=30) ``` The same construction is used for credential-bearing requests at: - `scripts/human_detection.py:69-79` - `scripts/human_detection.py:97-103` - `scripts/human_detection.py:118-128` ### Technical Analysis The API destination is constructed directly from the `JF_ENDPOINT` environment variable without checking whether the hostname is one of the documented JFTech service endpoints. Consequently, any party capable of influencing the process environment can redirect API traffic to an arbitrary HTTPS server. Each redirected request discloses authentication-related information to that server: - The device access token is included in the URL path. - The user UUID and application key are included in request headers. - A timestamp and secret-derived signature are included in request headers. - Device configuration data is included in request bodies. TLS does not prevent this disclosure when the configured destination is controlled by the attacker and presents a valid certificate for its own hostname. The appl ...[truncated 2398 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request URL is derived from the JF_ENDPOINT environment variable and then used to send authenticated requests containing uuid, appKey, timestamp, and signature headers. If an attacker can influence the environment, they can redirect these signed device-management requests to an arbitrary host, enabling credential/header exfiltration and unauthorized remote control traffic to leave the trusted vendor domain.

Content

Scanner excerpt · scripts/human_detection.py (reported line 64)May include surrounding context.

python

if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

This POST sends configuration updates to a URL built from an environment-controlled endpoint, along with authentication material in headers. A malicious endpoint override could capture signed requests and device tokens or receive sensitive configuration payloads intended only for the vendor API.

Content

Scanner excerpt · scripts/human_detection.py (reported line 90)May include surrounding context.

python

"Detect.HumanDetection": config
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code transmits authenticated tracking-configuration requests to a URL derived from environment input without validating that the destination belongs to the expected service. In compromised runtime environments, this can be abused to exfiltrate signed headers and device-related data to attacker-controlled infrastructure.

Content

Scanner excerpt · scripts/human_detection.py (reported line 118)May include surrounding context.

python

if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

Tainted flow: 'url' from os.getenv (line 136, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

This configuration-setting call uses the same environment-controlled base URL, so an attacker with control over JF_ENDPOINT can redirect outbound authenticated traffic. Because the function performs state-changing operations, misuse could facilitate leakage of request metadata and abuse of device-management actions outside the intended API boundary.

Content

Scanner excerpt · scripts/human_detection.py (reported line 144)May include surrounding context.

python

"Detect.DetectTrack": config
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明的核心用途是设备侧的人形检测相关设置，而代码片段仅实现认证/签名辅助函数，属于接口加密支持模块。它没有任何与人形检测开关、灵敏度调整、云台追踪开关、设备控制、网络请求或相关触发逻辑对应的实现。因此该代码的实际行为与声明用途存在明显且实质性的不一致。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

| `SKILL.md` | 技能文档 |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation exposes that the implementation requires environment variables containing sensitive credentials and performs outbound API requests, yet the manifest declares no explicit tool scope or permission boundary. That creates an under-specified trust model: a caller may invoke a skill with network and secret access without transparent declaration or least-privilege constraints, increasing the chance of credential misuse or unintended exfiltration if the script is modified or compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language content exclusively in Chinese in the module docstring and later user-facing output, which imposes a specific language on users without any opt-in or stated regional justification. The policy calls for flagging language or locale constraints when the skill does not offer a choice or explain why the restriction is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The test block prints a Chinese-language notice and the surrounding comments remain Chinese-only, extending the language restriction to runtime interaction. Because the file does not offer alternate language output or explain a mandatory locale scope, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/human_detection.py (reported line 64)May include surrounding context.

python

if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/human_detection.py (reported line 90)May include surrounding context.

python

if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/human_detection.py (reported line 118)May include surrounding context.

python

if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/human_detection.py (reported line 144)May include surrounding context.

python

if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-facing descriptions in this file are written only in Chinese, which imposes a fixed language on users without any opt-in or alternative locale support. The stated policy flags language or locale constraints unless the skill offers a choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.