ClawHub
Back to skill

Security audit

jf-watchdog

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its camera-monitoring purpose, but its scheduled patrol workflow can expose API secrets and it handles surveillance images and credentials with weak scoping.

Review this skill carefully before installing. It is designed for real camera monitoring and will handle API credentials, device identifiers, local image files, baseline images, and possibly scheduled reports. Do not use the scheduled patrol template as written with plaintext secrets; use a secret manager or runtime environment injection instead, avoid passing unused passwords on the command line, and set clear retention and sharing rules for captured images.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tainted flow: 'image_url' from requests.post (line 237, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
"""下载图片到本地，失败重试一次"""
    for attempt in range(max_retries + 1):
        try:
            resp = requests.get(image_url, timeout=30)
            if resp.status_code == 200:
                os.makedirs(os.path.dirname(output_path), exist_ok=True)
                with open(output_path, 'wb') as f:
Confidence
86% confidence
Finding
resp = requests.get(image_url, timeout=30)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill requires reading environment variables, local files, writing configuration and baseline images, and making network calls, but it does not declare any permissions. This deprives users and the platform of an explicit trust boundary and makes the skill's real capabilities less transparent, which is especially risky for a surveillance-oriented skill handling credentials and images.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The scheduled patrol template instructs embedding plaintext environment-variable secrets directly into task content, and the same workflow contemplates pushing results to external IM channels. This creates a direct credential exposure path through logs, task definitions, screenshots, chat transcripts, or downstream integrations unrelated to the minimum monitoring function.

Context-Inappropriate Capability

Medium
Confidence
78% confidence
Finding
The capture-single action accepts a password parameter even though the value is never used. Introducing unnecessary credential-handling surface is risky because callers may supply sensitive secrets that can then appear in shell history, process listings, logs, or orchestration metadata for no functional reason.

Vague Triggers

High
Confidence
90% confidence
Finding
Broad trigger phrases like '检查一下' and '巡逻' are generic conversational expressions that can accidentally invoke a powerful skill capable of reading credentials, contacting APIs, and processing surveillance images. In this context, mis-triggering is more dangerous than usual because activation may initiate monitoring workflows or expose operational details without clear user intent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger condition allows the agent to start the workflow based on its own judgment that the user is a 'first-time user,' which is a vague and unbounded activation rule. Ambiguous autonomous triggering increases the chance of initiating environment checks, file reads, or setup flows without sufficiently explicit user consent.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The documentation instructs use of sensitive environment variables and device passwords but does not include corresponding user-facing warnings about secret handling, storage, exposure risks, or least-privilege practices. In a skill that also writes config files and generates task templates, this omission materially increases the chance of unsafe credential handling.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill captures, downloads, stores, crops, and presents surveillance images, but the documentation does not warn users about privacy, consent, retention, or data-sharing implications. Because the monitored scenes may contain people, vehicles, or sensitive facilities, missing privacy guidance raises legal and operational risk.

Ssd 3

High
Confidence
99% confidence
Finding
The template explicitly directs the agent to place full secret values such as JF_UUID, JF_APP_KEY, and JF_APP_SECRET into task text. Natural-language task bodies are often stored, inspected, copied, or transmitted across systems, making this a concrete secret leakage vulnerability with significant downstream compromise potential.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical
Code
suspicious.env_credential_access
Location
scripts/watchdog.py:68