ClawHub
Back to skill

Security audit

jf-open-pro-device-reboot

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can reboot or shut down remote devices using credentials without requiring confirmation by default.

Review before installing. Use this only with JF credentials you intend to expose to the skill, set JF_ENDPOINT only to a trusted documented JF API host, and require an explicit user confirmation step before any reboot or shutdown invocation.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tainted flow: 'url' from os.getenv (line 55, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
91% confidence
Finding
The request target is derived from the JF_ENDPOINT environment variable and then used to send signed control requests containing sensitive authentication material. If an attacker can influence the runtime environment, they can redirect device-operation traffic to an attacker-controlled host, enabling credential/header exfiltration and unauthorized replay or misuse of signed requests. In a device reboot/shutdown skill, this is more dangerous because the transmitted request is an authenticated operational command, not just ordinary telemetry.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation describes use of environment variables containing sensitive credentials and direct network access to a device-management API, but no explicit permissions are declared. This creates a transparency and policy-enforcement gap: an agent or user may invoke a skill with privileged capabilities without clear consent boundaries, increasing the risk of credential misuse or unauthorized device reboot/shutdown operations.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script permits reboot and shutdown commands to execute without an interactive confirmation unless --confirm is explicitly supplied. This increases the chance of accidental or automated disruptive actions against remote devices, especially when invoked by higher-level agents or scripts that may pass parameters directly. In this skill context, the action has immediate availability impact because it intentionally takes devices offline.

Static analysis

No suspicious patterns detected.