ClawHub
Back to skill

Security audit

jf-open-pro-device-status

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its device-status purpose, but it needs review because it can send credentials and device tokens to a configurable host and can expose WAN IP addresses.

Install only if you trust the JFTech API context and can keep JF_UUID, JF_APP_KEY, JF_APP_SECRET, and device tokens private. Set JF_ENDPOINT only to the intended official regional host, avoid running it in shared or untrusted environments, and be aware that table output can reveal device WAN IP addresses.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'url' from os.getenv (line 53, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"region": region
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
95% confidence
Finding
The request target is derived from the JF_ENDPOINT environment variable and used to construct the POST URL, while signed authentication headers and device tokens are sent in the same request. If an attacker can influence the environment, they can redirect traffic to an attacker-controlled host and capture sensitive credentials, signatures, and device identifiers despite HTTPS.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation instructs use of environment variables, local file input, and outbound network access, but no explicit permissions are declared. This creates a transparency and policy gap: users and the hosting platform may not realize the skill can access secrets, read token lists from files, and send data to external regional endpoints. In a device-management context, these capabilities are expected, but undeclared access still increases abuse potential and weakens reviewability.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill description says it is focused on returning online/offline status, but the table output also exposes each device's WAN IP address. WAN IPs are sensitive infrastructure metadata and can aid device/network enumeration or leak user environment details beyond the skill's stated purpose.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger phrases are broad, natural-language expressions likely to overlap with ordinary conversation, which can cause unintended skill activation. In this skill, accidental activation could expose device online/offline status or prompt outbound API calls using configured credentials, making the issue more than just a usability problem.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger section lists example phrases but does not define when the skill should not activate or how to distinguish eligible requests from general discussion. That ambiguity can lead to accidental execution, unnecessary network requests, and unintended disclosure of device status in shared environments.

Static analysis

No suspicious patterns detected.