ClawHub
Back to skill

Security audit

jf-watchdog

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent camera-monitoring skill, but it handles surveillance images and API secrets in ways users should review carefully before installing.

Install only if you are comfortable granting the agent access to JF camera APIs, local captured images, baseline images, and monitor configuration. Do not paste live JF_APP_SECRET or other secrets into scheduled task text, chat messages, or IM notifications; use environment variables or a secret store instead, and review where captures and baselines are saved and retained.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Tainted flow: 'url' from os.getenv (line 85, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/watchdog.py (reported line 68)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

Tainted flow: 'url' from os.getenv (line 85, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/watchdog.py (reported line 91)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

代码内容与描述的核心用途明显不一致。声明描述的是一个面向视觉监控场景的看门狗技能，应包含图像获取、分析、告警或状态判断等相关行为；但实际代码仅实现了 API 调用相关的辅助加密能力，包括计数器、时间戳、UTF-8 字节处理、字节移位、数组合并和 MD5 签名生成。这类代码更像是底层 OpenAPI 认证工具，而不是区域状态监控技能本身。虽然加密签名可能是调用杰峰接口的配套实现细节，但当前提供的代码片段本身完全没有体现声明中的主要功能，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

声明强调的是“通用区域状态监控”以及基于AI视觉分析的场景检测能力，意味着应存在图像理解、状态比对、异常判定或相关监控输出。实际代码只实现了四类CLI动作：批量抓图、单设备抓图、按配置裁剪图片、按传入区域裁剪baseline，属于数据采集和预处理工具。虽然“基于杰峰设备抓图”这一部分与描述部分一致，但核心能力“AI视觉分析”和具体监控场景检测并未出现在该代码中，因此描述对代码能力有明显夸大/不准确之处。

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases include generic expressions like '检查一下' and '巡逻', which can overlap with ordinary conversation and unintentionally activate a skill that reads config, accesses environment variables, calls device APIs, and writes files. Broad activation increases the chance of unauthorized or surprising execution in contexts where the user did not intend to invoke monitoring behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section explicitly instructs putting plaintext secrets into scheduled task instructions, without warning that task bodies may be logged, synced, or exposed to operators and external systems. Because these are active API credentials for a surveillance workflow, exposure can directly compromise device access and captured media.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Embedding live secrets directly into a natural-language scheduled task creates multiple disclosure surfaces: prompt logs, scheduler metadata, debug output, exported task definitions, and downstream notifications. In this skill's context, leaked credentials could let an attacker query device APIs, retrieve camera captures, or manipulate monitoring workflows.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 680)May include surrounding context.

md
| `SKILL.md` | 技能文档 |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill handles device credentials, stores passwords in configuration, downloads surveillance images, and writes baseline/crop files without a clear privacy and security warning to the user. In a monitoring context, this omission is more serious because it affects both secret handling and potentially sensitive camera imagery.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Allowing activation based on 'Agent 判断用户是首次使用' creates subjective, implicit invocation conditions beyond clear user intent. For a skill that can inspect environment state and operate on surveillance-related data, implicit activation increases the risk of unintended execution and privacy-invasive behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The prescribed user-facing dialogue is entirely in Chinese and the skill does not state that language selection is optional or region-limited. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless clearly justified and documented.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The scheduled-inspection template embeds live secrets such as JF_APP_SECRET directly into a natural-language task body and contemplates passing that body to schedulers or IM systems. This can leak credentials into prompts, logs, task definitions, chat history, and downstream integrations, enabling unauthorized API use and lateral access to device data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document declares lang="zh-CN", and the visible UI text throughout the file is exclusively in Chinese. Per the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

User-facing docstrings, help text, and runtime messages are written in Chinese throughout the script, which imposes a specific language/locale on users. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/watchdog.py (reported line 68)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/watchdog.py (reported line 91)May include surrounding context.

python
url = f"{JF_BASE_URL}/rtc/device/token"
    headers = get_headers(uuid, app_key, app_secret, move_card)
    body = {"sns": device_sns, "accessToken": ""}
    response = requests.post(url, headers=headers, json=body, timeout=30)
    result = response.json()
    if result.get("code") != 2000:
        raise RuntimeError(f"获取设备 Token 失败：{result.get('msg', '未知错误')}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code sends device serial numbers and authentication-derived headers to a remote API via requests.post, but there is no confirmation prompt and no user-facing disclosure near the operation about transmitting device/system data off-host. For a code file, network calls that transmit such data should have some visible warning unless clearly documented elsewhere in-scope, which is not present in this file.

Content

No source excerpt is available for this finding.

Tainted flow: 'image_url' from requests.post (line 237, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
92% confidence
Finding

The script downloads an image from a URL returned by a prior network response without validating the scheme, host, or destination. If the upstream API, DNS, or endpoint configuration is compromised, this can turn the script into an SSRF client or cause retrieval of attacker-controlled content, which is then written to disk.

Content

Scanner excerpt · scripts/watchdog.py (reported line 107)May include surrounding context.

python
"""下载图片到本地，失败重试一次"""
    for attempt in range(max_retries + 1):
        try:
            resp = requests.get(image_url, timeout=30)
            if resp.status_code == 200:
                os.makedirs(os.path.dirname(output_path), exist_ok=True)
                with open(output_path, 'wb') as f:

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

这里的文字意图是仅检查环境变量是否存在，但紧接着又建议使用 echo %JF_UUID% 或 Bash 命令读取变量内容。前者意味着实际操作会取出并可能暴露敏感值，与“静默检查”这一表述存在明显意图偏差。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module title and all docstrings are written in Chinese, which imposes a specific language on maintainers or users reading the skill without any opt-in or stated regional justification. The policy allows locale constraints when clearly documented and justified, but this file does not explain that the skill is intentionally China-region or Chinese-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The function creates directories and writes downloaded image data to disk, but the helper itself contains no warning comment or disclosure about local file creation. Although higher-level success messages exist after completion, they do not warn users in advance that capture operations will persist screenshots locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill's stated purpose is area-state monitoring based on device snapshots and visual analysis, and the code's implemented operations are token-based capture and local image cropping. However, the script exposes a --password argument and threads it into action_capture_single, even though that value is never used for capture or cropping, making credential collection unjustified by the documented purpose of this tool.

Content

No source excerpt is available for this finding.