ClawHub
Back to skill

Security audit

jf-garbage-inspection

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its camera-inspection purpose, but it needs review because it can save surveillance images locally and create scheduled jobs that may expose API credentials or send reports externally without enough safeguards.

Install only if you trust the JF API endpoint and need automated camera snapshot inspection. Do not place real JF_UUID, JF_APP_KEY, JF_APP_SECRET, or JF_MOVE_CARD values in cron task messages; use a secure secret store or runtime environment binding. Treat downloaded captures as sensitive surveillance data, restrict recipients before enabling IM pushes, and add cleanup plus URL/content validation before using it in a shared or production workspace.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Tainted flow: 'url' from os.getenv (line 71, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/capture_and_download.py (reported line 54)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

Tainted flow: 'url' from os.getenv (line 71, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/capture_and_download.py (reported line 77)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

该代码块的核心行为是“设备抓图 + 图片下载”。它通过杰峰 API 获取 device token，调用抓图接口，并将返回的 image URL 下载到本地目录。输出的 JSON/文本仅包含成功失败、文件路径、URL、错误信息等操作结果，不包含任何垃圾桶状态识别、溢出等级、巡检结论或分析结果。因此，与声明中的主要用途相比，代码只覆盖了前置的数据采集环节，没有实现关键的分析与巡检报告能力。此外，声明提到支持定时任务，但本代码中没有调度、cron、轮询或任务注册相关实现。虽然单设备/批量巡检部分与声明部分一致，但整体上描述夸大了实际功能，属于明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个面向监控巡检的业务技能，核心应围绕设备抓图、视觉分析和报告生成。但提供的代码片段完全是底层加密签名工具，用于构造时间戳和请求签名，属于调用杰峰 OpenAPI 的辅助组件。虽然这类加密代码可能是整个技能的支撑实现之一，但就该代码片段本身而言，其实际行为与“垃圾溢出巡检”主功能不一致，也没有体现任何描述中的核心业务能力。因此应判定为描述与代码行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The scheduled-task template instructs embedding raw secrets like JF_UUID, JF_APP_KEY, JF_APP_SECRET, and JF_MOVE_CARD directly into a cron job message. That exposes credentials to downstream agents, logs, task metadata, or messaging systems, creating a clear secret-leak path and potentially enabling unauthorized API access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The scheduled-task example combines plaintext credential placeholders with automatic report pushing to external IM channels, but omits any warning about leakage through task definitions, logs, or message transport. Because this workflow handles surveillance images and service credentials, automatic externalization without safeguards materially raises confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The task template explicitly tells a later agent or channel to include complete environment-variable secrets in a natural-language message. That is a direct secret-exfiltration instruction: credentials may be visible to schedulers, logs, operators, or any system that stores or forwards the message, enabling unauthorized reuse of the platform account.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

md
| `SKILL.md` | 技能文档 |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

L003 及全文案均以中文定义触发词、引导语和报告格式，没有给出语言切换、用户选择或仅限中文用户场景的明确说明。根据语言/locale 政策，强制单一语言而无用户 opt-in 可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L019 的“巡检怎么用”和 L020 的“检查垃圾”都较为宽泛，缺少明确限定为本技能、杰峰设备或垃圾桶溢出场景的约束。此类短语容易与普通咨询或其他检查类任务重叠，增加非预期唤起该技能的风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill requires multiple credential-bearing environment variables but provides no warning about secret handling, output redaction, or safe configuration practices. In combination with workflows that check or reuse env vars, this increases the chance of accidental exposure through terminal output, logs, or downstream prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly downloads camera snapshots to local storage and later presents those images, but it does not warn users about local persistence, retention, or the exposure of potentially sensitive real-world scenes. In a surveillance context, silent local storage of images increases privacy and data-handling risk, especially if workspaces are shared, backed up, or accessible to other tools.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

L113 写明“或 Agent 判断用户是首次使用”，但没有说明判断标准、排除条件或需要哪些上下文信号。这样的自然语言触发条件过于模糊，可能让技能在不合适的对话中进入引导流程。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/capture_and_download.py (reported line 54)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/capture_and_download.py (reported line 77)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code downloads captured camera images from a remote URL and saves them to disk, which affects user or site data and may have privacy implications. Although the script prints success/failure status, it does not provide a user-facing warning or disclosure that surveillance images will be retrieved and persisted locally.

Content

No source excerpt is available for this finding.

Tainted flow: 'image_url' from requests.post (line 172, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
95% confidence
Finding

The script downloads from image_url returned by a remote API without validating the scheme, host, or address range. If the upstream service is compromised or a malicious endpoint is configured, this can be abused as SSRF to make the agent connect to arbitrary internal or external URLs and write attacker-controlled content to disk.

Content

Scanner excerpt · scripts/capture_and_download.py (reported line 93)May include surrounding context.

python
"""下载图片到本地，失败重试一次"""
    for attempt in range(max_retries + 1):
        try:
            resp = requests.get(image_url, timeout=30)
            if resp.status_code == 200:
                os.makedirs(os.path.dirname(output_path), exist_ok=True)
                with open(output_path, 'wb') as f:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module title and descriptive docstrings are written entirely in Chinese, which imposes a specific language on users and maintainers without any opt-in, bilingual alternative, or documented regional constraint. Under the stated policy, language-specific behavior is only acceptable when the locale restriction is clearly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The location field is populated with the Chinese term 办公室, which indicates a fixed language/locale choice in natural-language content. The file provides no user opt-in, locale selection mechanism, or documented reason that this configuration is intentionally region-specific.

Content

No source excerpt is available for this finding.