ClawHub
Back to skill

Security audit

jf-open-pro-device-osd

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed camera OSD configuration helper that uses user-provided JFTech credentials to call the JFTech cloud API, with some operational cautions but no hidden or malicious behavior found.

Install only if you intend to let this skill send your JFTech app credentials and device token to a JFTech cloud endpoint to read or change camera OSD settings. Keep JF_ENDPOINT set to one of the documented JFTech regional domains and do not rely on the unimplemented time-title or privacy-area examples without checking the script first.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tainted flow: 'url' from os.getenv (line 91, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
94% confidence
Finding
The request URL is derived from JF_ENDPOINT, which comes from an environment variable and is used directly in requests.post while sending authentication headers including uuid, appKey, timeMillis, and signature. If an attacker can influence the runtime environment, they can redirect these signed requests and device identifiers to an attacker-controlled host, causing credential leakage and unauthorized outbound communication.

Tainted flow: 'url' from os.getenv (line 91, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
94% confidence
Finding
This POST sends signed authentication material to a URL built from the environment-controlled JF_ENDPOINT. In a skill context, environment variables are often easier to tamper with than source code, so a malicious operator or compromised deployment could exfiltrate request metadata and device-related configuration operations to an attacker server.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill requires environment secrets and makes remote network calls, but the documentation does not declare permissions or clearly surface those capabilities as formal requirements. This can mislead users and reviewers about the trust boundary, especially because the skill handles app secrets, device tokens, and cloud API access to modify device configuration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose does not fully match the skill's actual behavior: it relies on signing logic, contacts external cloud APIs, and appears to overstate implemented features while omitting important operational details. This mismatch is dangerous because users may authorize execution under incorrect assumptions, exposing credentials and allowing remote device configuration changes they did not clearly consent to.

Static analysis

No suspicious patterns detected.