jf-garbage-inspection

• Outcome: Review
• Latest audit: Jul 30, 2026 · 1:47 PM UTC
• Version: 1.0.0

Overview

This camera-inspection skill is not clearly malicious, but it needs Review because it handles sensitive camera credentials, surveillance images, and scheduled reporting with weak scoping and secret-handling guidance.

Install only if you trust the publisher and are comfortable granting camera/API access. Keep JF_ENDPOINT limited to official vendor domains, avoid storing camera passwords in shared plaintext files, do not inline API secrets in scheduled-task messages, and decide how captured images should be retained or deleted before enabling automatic inspections or IM reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'url' from os.getenv (line 71, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

• Confidence: 92% confidence
• Finding: response = requests.post(url, headers=headers, json=body, timeout=30)

Tainted flow: 'url' from os.getenv (line 71, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"Name": "OPSNAP",
        "OPSNAP": {"Channel": channel, "PicType": pic_type}
    }
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"抓图失败：{result.get('msg', '未知错误')}")

• Confidence: 92% confidence
• Finding: response = requests.post(url, headers=headers, json=body, timeout=30)

Tainted flow: 'image_url' from requests.post (line 172, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

"""下载图片到本地，失败重试一次"""
    for attempt in range(max_retries + 1):
        try:
            resp = requests.get(image_url, timeout=30)
            if resp.status_code == 200:
                os.makedirs(os.path.dirname(output_path), exist_ok=True)
                with open(output_path, 'wb') as f:

• Confidence: 95% confidence
• Finding: resp = requests.get(image_url, timeout=30)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs access to environment variables, local files, and external network APIs, but does not declare those capabilities as permissions. This creates a transparency and consent problem: users and platforms cannot accurately assess what the skill can access, and sensitive camera/device data may be handled without explicit authorization boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior promises image-based garbage overflow analysis and scheduling, but the static finding indicates the implementation only performs capture/download and lacks the advertised analysis and reporting features. This mismatch is dangerous because users may rely on the skill for safety or sanitation monitoring while it silently fails to provide the expected inspection outcome.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill extends from image inspection into IM-channel enumeration and scheduled report delivery, which expands its operational scope and access to communications metadata. That broader capability increases the blast radius if the skill is misused or compromised, especially because it can automate outbound reporting beyond the core inspection purpose.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The setup workflow tells the agent to execute shell commands to inspect environment variables, introducing command-execution behavior that is broader than simple analytics. Even if the commands are intended for benign checks, normalizing shell execution increases the risk of accidental command injection, credential exposure, or unsafe adaptation in future revisions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The core workflow requires launching a local Python script, adding subprocess execution capability beyond the manifest's stated analytics role. Subprocess execution materially increases risk because it can be a vehicle for unexpected code execution, filesystem access, and network operations under the agent's privileges.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases are broad and overlap with ordinary conversation, which can cause the skill to activate unintentionally. For a skill that can access cameras, files, environment variables, and network APIs, accidental invocation raises the chance of unintended data access or operational actions.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The workflow can trigger when the agent merely 'judges' that the user is a first-time user, which is ambiguous and may cause unsolicited environment and configuration checks. Ambiguous activation is risky here because the skill performs sensitive discovery actions before the user has clearly consented.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description says captured images are downloaded locally but omits a warning that surveillance images and camera configuration data will be stored on disk. This is dangerous because users may not realize potentially sensitive visual data and device metadata persist locally, increasing privacy, retention, and unauthorized-access risks.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The configuration example stores device passwords directly in config/cameras.json without a warning or protective guidance. Plaintext credential storage is a serious issue because anyone with file access can recover camera credentials and potentially access devices or pivot into related infrastructure.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The scheduled-task example embeds JF_UUID, JF_APP_KEY, JF_APP_SECRET, and JF_MOVE_CARD directly into task instructions, effectively exposing secrets in job definitions or logs. If those tasks are inspectable by other users or services, the credentials could be harvested and abused to access the vendor API and associated devices.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/capture_and_download.py:54