ClawHub
Back to skill

Security audit

jf-open-pro-smart-doorlock-control

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed smart-lock control skill, but it can remotely unlock a physical door without built-in confirmation or strong endpoint controls.

Review before installing. Only use this with trusted JF accounts and devices, restrict JF_ENDPOINT to the documented vendor regional hosts, protect the environment variables as credentials, and add an explicit confirmation or approval step before any unlock command is run. Avoid generic triggers for unlock actions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'url' from os.getenv (line 164, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if access_token:
        body["accessToken"] = access_token

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:
Confidence
93% confidence
Finding
The request destination is derived from the JF_ENDPOINT environment variable and then used to construct HTTPS URLs for API calls. An attacker who can influence the environment can redirect requests carrying authentication headers, signatures, device identifiers, and possibly access tokens to an attacker-controlled host, enabling credential exfiltration and unauthorized device operations.

Tainted flow: 'url' from os.getenv (line 164, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
body = {"Name": "DoorFunction"}

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:
Confidence
93% confidence
Finding
This API call uses a URL built from JF_ENDPOINT, so the destination can be redirected by environment manipulation. Because the request includes signed headers and device-related metadata, a malicious endpoint could harvest sensitive values and observe capability queries tied to the target lock.

Tainted flow: 'url' from os.getenv (line 164, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    }

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:
Confidence
93% confidence
Finding
The door lock configuration request is sent to a host derived from environment state without trust validation. This can leak authenticated request material and detailed lock configuration data to an attacker-controlled server, which is particularly sensitive in a physical-security context.

Tainted flow: 'url' from os.getenv (line 164, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if keepalive_time > 0:
        body["KeepaliveTime"] = keepalive_time

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:
Confidence
93% confidence
Finding
The device login request sends username/password material to a URL based on JF_ENDPOINT, so endpoint spoofing can directly exfiltrate device credentials. In this skill, that is especially dangerous because the login capability can provide ongoing authenticated access to the smart lock device.

Tainted flow: 'url' from os.getenv (line 164, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"memberID": 1
        }

    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()

    if result.get("code") != 2000:
Confidence
95% confidence
Finding
The unlock command is transmitted to a URL constructed from an environment-controlled endpoint, together with authentication headers and device identifiers. If the environment is compromised, an attacker can intercept secrets and potentially manipulate or replay remote unlock-related traffic in a smart-lock context, creating serious physical-security risk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation describes use of environment variables holding sensitive credentials and device tokens, and remote network access to vendor APIs, but the skill metadata does not declare corresponding permissions. This creates a transparency and governance gap: operators may approve or invoke a skill without understanding it can read secrets and perform external actions, including physically unlocking a door.

Vague Triggers

Medium
Confidence
89% confidence
Finding
Including an overly broad trigger such as “开锁” increases the chance of accidental invocation from ordinary conversation or ambiguous requests. In this skill’s context, accidental execution is especially dangerous because the action can remotely unlock a physical door, turning a trigger-quality issue into a real safety and security risk.

Missing User Warnings

High
Confidence
97% confidence
Finding
The documentation explicitly presents passwordless one-click remote unlock as a normal operation, but does not require step-up authentication, explicit user confirmation, or strong risk warnings immediately before execution. Because the action controls a smart door lock, misuse, accidental invocation, or account/session compromise could directly enable unauthorized physical entry.

Missing User Warnings

High
Confidence
89% confidence
Finding
The skill can issue a remote unlock immediately when invoked with the unlock action, without any explicit confirmation, warning, or second-factor step in the tool itself. In a smart-lock context, accidental invocation, prompt misuse, or weak upstream authorization can directly cause unauthorized physical access.

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical
Code
suspicious.env_credential_access
Location
scripts/doorlock_control.py:65