jf-store-traffic

• Outcome: Review
• Latest audit: Aug 17, 2026 · 2:45 AM UTC
• Version: 1.0.0

Overview

The skill matches its store-traffic purpose, but it needs Review because it can access live camera imagery, transmit camera credentials, and delete store/device resources with limited safeguards.

Install only if you are comfortable giving the skill JF API credentials and camera access. Use the fixed official endpoint, avoid default or empty camera passwords, confirm exact store/device IDs before delete commands, and treat generated HTML reports as sensitive because they may load third-party chart code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tainted flow: 'url' from os.getenv (line 110, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

for attempt in range(retries + 1):
        try:
            resp = requests.post(url, json=body, headers=headers, timeout=30)
            result = resp.json()
        except requests.RequestException as exc:
            if attempt < retries:

• Confidence: 95% confidence
• Finding: The destination host is derived from the JF_ENDPOINT environment variable and used directly to build the HTTPS API URL for all authenticated requests. If an attacker can influence the runtime environment, they can redirect signed requests and operational data to an attacker-controlled server, enabling credential/header exfiltration and unauthorized remote actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs use of environment variables, local file reads/writes, and outbound network access, yet no explicit permissions are declared. This creates a trust and review gap: an agent may handle credentials, session files, generated HTML, and live API calls without users or the runtime having clear consent boundaries. In a skill that provisions devices and queries business analytics, undeclared capabilities materially increase the chance of over-privileged or surprising behavior.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The template loads executable JavaScript from public CDNs at report runtime, with a fallback to a second third-party CDN. Any CDN compromise, dependency hijack, MITM on an untrusted network, or unexpected upstream change could execute arbitrary script in the report context, exposing embedded analytics data or altering the rendered report. In this skill, the HTML report is intended for local visualization only, so remote code loading is not necessary and increases supply-chain risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The API reference exposes a "snapshot" workflow that obtains a device token, logs into the camera, retrieves a live stream URL, and saves a video frame. That materially expands the skill from traffic analytics/configuration into direct surveillance access, which is sensitive because it enables collection of raw visual data rather than only aggregate counts; in this skill context, that is more dangerous because the manifest emphasizes deployment and analytics, not operator access to camera imagery.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented workflow includes delete-device and delete-store operations without an explicit confirmation or warning step immediately attached to those commands. In an operational skill managing stores and devices, accidental execution could remove production resources, disrupt traffic analytics, and cause data loss or service interruption, especially if session state auto-fills target IDs.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs use of the default administrator username with an empty password to log into devices, without a prominent warning or requirement to change credentials. This is dangerous because it normalizes insecure defaults and can lead to unauthorized camera access if operators leave devices unchanged; paired with the snapshot flow, it directly facilitates compromise of live video access.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The snapshot flow sends device credentials to remote API endpoints as part of login and livestream requests, but the tool provides no strong warning, masking, or safer credential-handling path. In a skill context, operators may paste production camera credentials without realizing they are being transmitted through the vendor cloud workflow, increasing exposure of sensitive surveillance access.

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/store_traffic.py:115