ClawHub
Back to skill

Security audit

jf-open-pro-video-masking

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its camera privacy-masking purpose, but it sends signed device-control requests and device tokens to a hostname taken directly from an environment variable without enforcing the documented JFTech endpoints.

Review before installing. Only run it with JF_ENDPOINT set to an official JFTech regional host, keep the app secret and device token scoped and rotated, and understand that enable/disable can change camera position, preview, and recording state. Do not use this package in an environment where untrusted users or scripts can set its environment variables.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'url' from os.getenv (line 56, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
]
    }
    
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    
    if result.get("code") != 2000:
Confidence
96% confidence
Finding
The request URL is derived from JF_ENDPOINT, which is taken directly from an environment variable and then used to send authenticated requests containing uuid, appKey, signature, and device control commands. If an attacker can influence the environment, they can redirect traffic to an attacker-controlled host and capture request metadata or induce unauthorized device-control attempts, making this more serious than a generic outbound request.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documentation describes use of environment variables containing sensitive credentials and making authenticated network requests, but it does not declare corresponding permissions/capabilities. This creates a transparency and policy gap: users or hosting systems may not realize the skill can access secrets and communicate with external vendor APIs, increasing the risk of credential misuse, unexpected data exfiltration, or unsafe execution in environments that rely on declared permissions.

Static analysis

No suspicious patterns detected.