Security audit

jf-open-pro-livestream

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles live camera access URLs and device credentials without enough scoping or secret-handling safeguards.

Review this skill carefully before installing. Use it only for devices you are authorized to access, keep JF_APP_SECRET, JF_DEVICE_TOKEN, device passwords, and returned livestream URLs out of chat logs, shell history, CI logs, and screenshots, and prefer short URL expirations. Do not set JF_ENDPOINT to an untrusted host because credentials and device access data are sent there.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation clearly requires environment variables containing secrets and instructs use of a Python script that performs outbound API calls, yet no declared permissions are described. This creates a transparency and governance gap: users or platforms may not realize the skill accesses credentials and contacts remote services, which increases the chance of unsafe deployment and insufficient review.

Description-Behavior Mismatch

Low

Confidence: 90% confidence
Finding: The test-url action performs a HEAD request to whatever URL is returned by the upstream API, which can cause the agent to initiate outbound connections to arbitrary hosts. If the upstream service, configuration, or response is compromised, this becomes an SSRF-style network probe capability and extends the skill beyond merely fetching preview URLs.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger phrases are broad and overlap with common user requests such as live preview, playback, and getting a video URL. Overbroad triggers can cause the skill to activate unintentionally in unrelated contexts, potentially exposing device stream URLs or causing sensitive operations to run without clear user intent.

Vague Triggers

Low

Confidence: 72% confidence
Finding: The trigger documentation lists activation phrases but does not define scope boundaries, exclusions, or when the skill should refuse to activate. This ambiguity increases the risk of accidental invocation and misuse, especially because the skill retrieves access-controlled livestream URLs tied to user devices.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation enumerates highly sensitive credentials including app secrets, device tokens, and optional device passwords, and even provides example export commands, but does not warn about storage, logging, shell history, or disclosure risks. Leakage of these values could allow unauthorized API use, device access, and stream retrieval.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill focuses on obtaining livestream URLs but does not explain that such URLs may grant direct access to live camera feeds for their validity period and may be reusable or shareable. In the context of surveillance or device monitoring, accidental disclosure of these URLs can directly expose private video streams and undermine access control.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script prints the full livestream URL to stdout, and these URLs may embed time-bound access tokens or otherwise grant direct access to a device stream. In agent, CI, terminal-logging, or shared-session environments, stdout may be captured and retained, causing unintended disclosure of sensitive stream access.

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

Code: suspicious.env_credential_access
Location: scripts/livestream.py:72