ClawHub
Back to skill

Security audit

jf-open-pro-traffic-heatmap

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its heatmap-reporting purpose, but it handles surveillance-style camera analytics with recurring capture, IM sharing, runtime downloads, and weak credential/data-scope guidance that should be reviewed before installation.

Review this skill before installing in any real camera environment. Only use it where camera monitoring and occupancy analytics are authorized, keep reports local unless IM recipients and schedules are explicitly approved, avoid putting JF secrets in cron messages, provide model files manually or verify downloaded weights, and pin patched dependency versions before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly performs file reads/writes and outbound network access, but it does not declare those capabilities or permissions. Undeclared capabilities reduce transparency and prevent proper policy gating, which is especially risky here because the skill processes camera images and may download model files from the internet.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The declared purpose focuses on heatmap analytics, but the behavior also includes automatic GitHub downloads and extra output generation such as summary files and push-oriented artifacts. This mismatch can mislead users and reviewers about outbound network activity and data dissemination, weakening informed consent and security review.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill expands beyond local heatmap analysis into IM conversation enumeration and automated message delivery, which are separate operational capabilities with privacy implications. Enumerating conversations and pushing summaries can expose sensitive occupancy analytics to unintended recipients if not tightly scoped and explicitly authorized.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The documentation explicitly instructs embedding JF_UUID, JF_APP_KEY, JF_APP_SECRET, and related secrets in cron task message text. Storing credentials in plain-language task payloads creates a direct secret exposure path through logs, task definitions, debugging output, and anyone able to inspect scheduled jobs.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The skill first says device communication must be delegated to other skills, but later directs scheduled tasks to use raw credentials in instructions for capture operations. This contradiction encourages bypassing the intended trust boundary and could lead to direct secret handling or ad hoc device access outside the audited dependency skills.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The database schema persists camera passwords in plaintext and also stores image paths tied to detection history. In an indoor people-traffic analytics skill, retaining raw credentials and traceable image metadata broadens the data exposure surface beyond what is strictly required for heatmap/report generation; if the SQLite file is read, copied, or backed up insecurely, an attacker could recover camera access credentials and sensitive surveillance references.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill is described as local indoor traffic analysis, but it includes hardcoded external URLs for model weights and will fetch them at runtime if local files are absent. This creates a supply-chain and privacy boundary risk because execution behavior depends on remote content outside the local deployment, which is inconsistent with the stated offline/local purpose.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The download function gives the skill active runtime network retrieval capability, including retries, and writes the retrieved artifact directly into the skill's model directory for later loading. If the remote source is tampered with or substituted, the system may consume untrusted model artifacts, introducing supply-chain compromise and undermining assumptions that the skill only performs local image analysis.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger list is broad enough to cause unintended activation for generic phrases such as reports, usage, or detection topics. Unintended invocation is not a direct exploit by itself, but it increases the chance of accidental camera-analysis workflows starting in contexts where the user did not clearly request surveillance-related processing.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The workflow adds vague activation phrases beyond the declared triggers, making invocation scope less predictable. In a skill that can capture images, write files, download models, and schedule tasks, fuzzy activation language increases the risk of accidental execution without clear user intent.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill captures and analyzes images of people from cameras, yet it does not prominently warn about privacy, surveillance, retention, or consent implications. In this context, omission of a privacy notice is significant because the data concerns identifiable human presence and movement patterns in indoor spaces.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill documents automatic model download from GitHub but does not clearly warn users that it will initiate outbound network access and fetch executable model artifacts. Silent or weakly disclosed downloads create supply-chain and policy-compliance risks, especially in restricted environments.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The scheduled workflow includes automatic sending of analysis summaries to IM conversations without a strong warning that data will leave the local analysis context. Because occupancy summaries may reveal business activity patterns or employee/customer presence, automatic external transmission raises confidentiality concerns.

Ssd 3

High
Confidence
99% confidence
Finding
The scheduled-task example instructs the operator to place sensitive environment variable values directly into natural-language message content. This is dangerous because task payloads are often stored, logged, inspected, and forwarded in plaintext, creating a high-likelihood credential disclosure channel.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# traffic-heatmap-skill dependencies
opencv-python>=4.8.0
numpy>=1.24.0
ultralytics>=8.0.0
requests>=2.28.0
Confidence
94% confidence
Finding
opencv-python>=4.8.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# traffic-heatmap-skill dependencies
opencv-python>=4.8.0
numpy>=1.24.0
ultralytics>=8.0.0
requests>=2.28.0
matplotlib>=3.7.0
Confidence
90% confidence
Finding
numpy>=1.24.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# traffic-heatmap-skill dependencies
opencv-python>=4.8.0
numpy>=1.24.0
ultralytics>=8.0.0
requests>=2.28.0
matplotlib>=3.7.0
Confidence
92% confidence
Finding
ultralytics>=8.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
opencv-python>=4.8.0
numpy>=1.24.0
ultralytics>=8.0.0
requests>=2.28.0
matplotlib>=3.7.0
Confidence
96% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.24.0
ultralytics>=8.0.0
requests>=2.28.0
matplotlib>=3.7.0
Confidence
89% confidence
Finding
matplotlib>=3.7.0

Known Vulnerable Dependency: opencv-python==4.8.0 — 2 advisory(ies): GHSA-qr4w-53vh-m672 (opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023); PYSEC-2023-183 (opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that )

High
Category
Supply Chain
Confidence
98% confidence
Finding
opencv-python==4.8.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
requests==2.28.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.