jf-open-pro-feed-control

• Outcome: Review
• Latest audit: Jul 30, 2026 · 1:39 PM UTC
• Version: 1.0.1

Overview

This skill is transparent about controlling a pet feeder, but it can immediately dispense food or change feeding automation and sends signed device-control requests to any endpoint named in an environment variable.

Review this before installing if an agent may act on ambiguous prompts. Use only trusted JF_ENDPOINT values from the documented regional hosts, keep JF_APP_SECRET and JF_DEVICE_TOKEN scoped and private, and require explicit user confirmation around feeding and schedule-changing commands.

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tainted flow: 'url' from os.getenv (line 230, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if access_token:
        body["accessToken"] = access_token

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:

• Confidence: 96% confidence
• Finding: The request target is derived from JF_ENDPOINT, which is controlled by an environment variable and then used to build URLs for authenticated API calls. If an attacker can influence the environment, the script will send signed requests and potentially sensitive identifiers or access tokens to an arbitrary host, creating a server-side request forgery and credential exfiltration path.

Tainted flow: 'url' from os.getenv (line 230, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

body = {"Name": "FeederAbility"}

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:

• Confidence: 96% confidence
• Finding: This call uses a URL ultimately derived from the environment-controlled JF_ENDPOINT and includes authentication headers with uuid, appKey, timestamp, and signature. Redirecting these requests to an attacker-controlled endpoint would expose signed request metadata and device-operation context outside the intended vendor API.

Tainted flow: 'url' from os.getenv (line 230, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

}
    }

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:

• Confidence: 97% confidence
• Finding: The feed command is sent to a URL built from an environment-derived base endpoint, so a manipulated environment can cause the skill to transmit authenticated device-control requests to an arbitrary external service. In this skill context, that is especially dangerous because the transmitted payload includes real device identifiers and action parameters for a physical pet feeder.

Tainted flow: 'url' from os.getenv (line 230, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"props": ["feedPlan"]
    }

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:

• Confidence: 95% confidence
• Finding: The schedule-query request is sent to a host derived from JF_ENDPOINT without trust validation. An attacker controlling that variable could siphon signed requests and device metadata, and in this device-management context the exposed information can aid unauthorized monitoring or further misuse of the feeder account.

Tainted flow: 'url' from os.getenv (line 230, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if method:
        body["props"]["method"] = method

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:

• Confidence: 97% confidence
• Finding: This schedule-setting call sends authenticated automation changes to a URL derived from an environment variable. If the endpoint is maliciously replaced, the request can leak schedule contents and signatures, and an attacker may trick operators into believing changes were sent to the real device service when they were not.

Tainted flow: 'url' from os.getenv (line 230, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

url = f"{JF_BASE_URL}/rtc/device/petDetectionSwitchStatus/{device_token}"
    headers = get_headers(uuid, app_key, app_secret, move_card)

    response = requests.post(url, headers=headers, timeout=30)
    result = response.json()

    if result.get("code") != 2000:

• Confidence: 95% confidence
• Finding: The pet-detection status request uses the same environment-derived base URL and authenticated headers, so it can be redirected to an attacker-controlled server. Even though this call is read-oriented, it still exposes sensitive request metadata and device tokens in the URL path to an untrusted destination.

Tainted flow: 'url' from os.getenv (line 230, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

body = {"Switch": switch}

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:

• Confidence: 97% confidence
• Finding: This state-changing request for pet-detection settings is sent to a URL built from JF_ENDPOINT without verification. In the context of an IoT control skill, allowing authenticated control traffic to be redirected externally can leak operational secrets and undermine trust in whether monitoring settings were truly changed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes use of environment variables, local files, and outbound network access, but no explicit permissions are declared. This creates a capability/permission mismatch that can mislead reviewers and users about what the skill can access, reducing transparency and weakening policy enforcement around secret handling and external API calls.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This skill performs physical-world actions by remotely dispensing food, but the description does not clearly warn users about the operational risks of triggering feeding remotely or misconfiguring schedules. In an IoT pet-care context, accidental or repeated execution could affect animal health, device state, or create unsafe feeding behavior, so missing user-facing risk disclosure is a meaningful safety weakness.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill performs a real physical-device action immediately after parsing arguments, with no confirmation, dry-run mode, or safety interlock. In an IoT pet-feeding context, accidental or socially engineered invocation can cause unintended feeding, which has real-world safety and operational consequences even if it is not a classic software exploit.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill overwrites scheduled feeding behavior without requiring user acknowledgment of the impact. In this context, automation controls a pet's feeding routine, so mistaken invocation or misunderstood parameters can materially affect animal care and is more serious than a typical convenience-setting change.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The add-schedule path modifies future feeding automation immediately after assembling a cron rule, without confirmation or review. Because this skill controls a pet feeder, unintended schedule changes can accumulate into repeated real-world effects and are more dangerous than ordinary preference updates.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The skill toggles device monitoring behavior without any warning or confirmation. While lower impact than feeding or schedule changes, silently altering pet-detection behavior can still reduce expected monitoring coverage and create user safety/privacy surprises in an IoT device context.

Static analysis

No suspicious patterns detected.