ClawHub
Back to skill

Security audit

jf-open-pro-device-image-flip

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward camera image-flip helper that uses disclosed JFTech API credentials to query or change device orientation settings.

Install only if you intend to let the skill control a JFTech camera's image orientation. Provide credentials with the minimum device scope available, keep JF_ENDPOINT set to the official regional JFTech API host you use, and expect set/reset actions to change the live device configuration until changed again.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tainted flow: 'url' from os.getenv (line 80, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
The request destination is derived from the JF_ENDPOINT environment variable and then used to construct the HTTPS URL for authenticated API calls. If an attacker can influence that environment variable, the script will send signed requests and device identifiers to an attacker-controlled host, enabling credential misuse, request replay opportunities, or unauthorized device-management traffic.

Tainted flow: 'url' from os.getenv (line 80, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Camera.Param": config
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
This state-changing configuration request also uses a URL built from the environment-controlled JF_ENDPOINT value. That makes the more sensitive write operation vulnerable to SSRF-style redirection or exfiltration of authentication material and device configuration to an attacker-selected server.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill requires access to environment variables and makes network calls, but the documentation does not declare those capabilities as permissions. This creates a transparency and governance gap: operators may not realize the skill consumes secrets like app credentials and device tokens or sends data to remote endpoints, increasing the chance of unsafe deployment and over-trust.

Static analysis

No suspicious patterns detected.