ClawHub
Back to skill

Security audit

jf-open-pro-device-smart-alarm

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for JFTech smart alarm management, but it handles alarm credentials, private alarm images, and live device settings with insufficient endpoint scoping and safety warnings.

Install only if you trust this publisher and will configure credentials yourself. Set JF_ENDPOINT only to one of the documented JFTech regional API domains, protect JF_APP_SECRET and JF_DEVICE_TOKEN as secrets, and review every command that disables alarms, disables notifications, changes schedules, or retrieves alarm pictures.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
headers = get_headers(uuid, app_key, app_secret, move_card)
    headers["DeviceSn"] = device_sn
    
    response = requests.get(url, headers=headers, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
93% confidence
Finding
The request destination is derived from the JF_ENDPOINT environment variable, so anyone who can influence runtime environment can redirect signed requests and device identifiers to an attacker-controlled host. Because the code sends authentication headers including uuid, appKey, timeMillis, and signature, this becomes an SSRF/exfiltration risk rather than a harmless configuration feature.

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"accessToken": access_token
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
97% confidence
Finding
This POST sends both signed headers and the accessToken body field to a URL built from an environment-controlled endpoint. If JF_ENDPOINT is altered, the skill will transmit platform credentials and device-token request data to an attacker-controlled server, enabling credential theft and downstream device access.

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
url = f"{JF_BASE_URL}/rtc/device/getability/{device_token}"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    
    response = requests.post(url, headers=headers, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
92% confidence
Finding
The device ability query uses an endpoint derived from environment input and includes signed authentication headers. A maliciously set endpoint can capture those credentials and device_token values, exposing information about managed devices and enabling replay or abuse depending on the signature scheme.

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if channel is not None:
        body["Channel"] = str(channel)
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
94% confidence
Finding
This configuration-read request can be redirected to an attacker-controlled host via JF_ENDPOINT, leaking signed headers and device_token-derived path data. In the context of a smart alarm skill, configuration data may reveal surveillance settings and operational schedules, increasing privacy and security risk.

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Detect.MotionDetect": config
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
96% confidence
Finding
This configuration-write request can be redirected through the environment-controlled base URL, causing the skill to send sensitive auth headers plus full alarm configuration content to an attacker-controlled server. Because the action changes alarm behavior, exploitation risks both credential theft and unauthorized surveillance/safety-impacting reconfiguration.

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if alarm_event:
        body["alarmEvent"] = alarm_event
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
92% confidence
Finding
Alarm list queries disclose surveillance event metadata and are sent to a host controlled by JF_ENDPOINT. An attacker who can influence environment configuration could collect alarm history, timestamps, and related monitoring details alongside signed API headers.

Tainted flow: 'url' from os.getenv (line 328, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if events:
        body["events"] = events
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
This request fetches alarm image URLs and can be redirected via an environment-controlled endpoint, exposing highly sensitive surveillance-related data and authenticated request material. In a smart alarm skill, image/event retrieval is especially dangerous because it may reveal private scenes, occupants, and activity patterns.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly relies on environment variables containing credentials and performs network operations against remote APIs, but the manifest does not declare corresponding permissions or capabilities. This can mislead reviewers and users about what the skill can access, reducing transparency and making secret handling and outbound data access easier to overlook.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill supports actions that enable or disable motion detection, mobile notifications, and alarm schedules, but it does not prominently warn users that these operations change live device behavior. A user could unintentionally weaken monitoring, suppress alerts, or alter surveillance coverage without realizing the operational consequences.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill can retrieve cloud-stored alarm events and associated image URLs, which may expose sensitive surveillance metadata and images, yet the description lacks any privacy warning. Because these functions do not require the device to be online or logged in to the device, the data-access capability is easy to underestimate and may increase privacy risk if misused.

Static analysis

No suspicious patterns detected.