jftech-open-pro-capture-livestream

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.0.0

Overview

This appears to be a real JF camera/device API helper, but it handles private device credentials and media links with weak endpoint scoping and log exposure risks.

Review this skill before installing in any agent or shared logging environment. Only run it with JF_ENDPOINT unset or set to a trusted official JF API host, treat printed tokens/session IDs/snapshot URLs/livestream URLs as credentials, and avoid running capture or livestream commands unless you intend to expose that device media to the current session output.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/jf_open_pro_capture_livestream.py:57

Finding

Unrestricted API Endpoint Allows Sensitive Information to Be Redirected

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jf_open_pro_capture_livestream.py:384

Finding

Device Tokens, Session IDs, and Private Media URLs Are Printed to Standard Output

Content

View full analysis

") print(" - VLC 播放：vlc \"URL\"") print(" - ffmpeg: ffmpeg -i \"URL\" output.mp4") print("\n⚠️ 地址有效期 10 小时，可重复使用") ``` ### Technical Analysis The script writes complete authentication artifacts and private media locations to standard output. Although stdout is convenient for interactive use, it is frequently captured by: - Agent conversation transcripts - CI/CD logs - Terminal recording systems - Container logging drivers - Shell wrappers and redirections - Monitoring and observability platforms - Shared support logs The documentation states that snapshot URLs remain valid for 24 hours and livestream URLs remain valid for approximately 10 hours. These URLs may func ...[truncated 1356 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:3

Finding

Dependency Version Is Not Reproducibly Pinned

Content

View full analysis

=2.28.0 ``` The documented installation command resolves this unrestricted version range: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis The dependency specification provides only a minimum version. It permits pip to install any later compatible release available at installation time and does not provide integrity hashes or a lock file. As a result, installations are not reproducible. The reviewed source package and transitive dependency versions may differ from those installed in the future. This creates avoidable supply-chain exposure if an unexpected, compromised, or incompatible release is published to the configured package index. No evidence was found that the current `requests` dependency is malicious. The confirmed issue is the absence of deterministic version and integrity controls. ### Attack Path 1. A user follows the documented installation command. 2. pip contacts the configured package index and resolves the latest release satisfying `requests>=2.28.0`. 3. The installed version or one of its transitive dependencies differs from the versions previously reviewed and tested. 4. If a resolved package release or package index is compromised, malicious package content is installed into the Skill's Python environment. 5. The malicious dependency executes when imported or used by the script and receives access to the same process environment, including JF credentials. ### Impact Assessment A compromised dependency would execute with the privileges of the user running the Skill. Because the script loads credentials from environment variables, malicious dependency code could potentially access: - `JF_UUID` - `JF_APPKEY` - `JF_APPSECRET` - `JF_SN` - `JF_USERNAME` - `JF_PASSWORD` - Other files and resources availab ...[truncated 270 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

代码核心功能与声明大体相关，确实涉及设备状态查询、登录、抓图和直播地址获取，因此不是完全无关。但声明中的关键卖点是“批量获取”“多设备多通道抓图”，而代码实际仅支持单个设备 SN，并且 capture/livestream 在主程序里固定对单一通道执行一次，没有批量循环、设备列表输入或多通道处理逻辑。这属于对主要能力的夸大，描述未准确反映实际行为，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises credential and endpoint usage and includes example shell and Python execution paths, but it does not declare an explicit tool/permission scope such as allowed network, environment-variable, or shell capabilities. In agent environments, missing scope declarations can cause over-broad execution privileges or make reviewers unable to enforce least privilege, increasing the chance of unintended command execution or secret access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Overly broad trigger phrases can cause the skill to activate in situations the user did not intend, especially for common actions like checking device state or querying devices. Because this skill can access credentials and make external network calls to retrieve device status, snapshots, or livestream URLs, accidental invocation can disclose sensitive device metadata or initiate billable operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The script sends device identifiers, authentication material, and potentially device usernames/passwords to a remote endpoint, and the destination host is configurable through the JF_ENDPOINT environment variable without validation or allowlisting. In a skill/agent context, a manipulated environment or configuration could redirect sensitive requests to an attacker-controlled server, causing credential and device-access token exfiltration.

Content

Scanner excerpt · scripts/jf_open_pro_capture_livestream.py (reported line 143)May include surrounding context.

python

headers['Content-Type'] = 'application/json'
        
        try:
            response = requests.post(url, headers=headers, json=body, timeout=30)
            return response.json()
        except Exception as e:
            return {'code': 0, 'msg': str(e)}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill documentation is written in Chinese and does not indicate that other languages are supported or that Chinese is a deliberate, region-specific requirement. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

L051 的自然语言注释“仅支持 Python”表达了对语言的硬性限制，但文件中未说明这是用户自选、平台约束，或为何必须限制为该语言。根据策略，若强制特定语言而未提供选择或明确合理说明，属于自然语言层面的政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language documentation and CLI output that force a single language/locale for all users. Under the policy rule, a fixed language is only acceptable when the tool offers user choice or clearly documents a justified regional constraint, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring says '仅支持环境变量' and '不支持命令行参数或配置文件', which broadly states that command-line parameters are unsupported. However, main() reads sys.argv[1] to control behavior such as status, login, capture, livestream, and token. This is a documentation/code contradiction, even though the command-line input is limited to operation selection rather than credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment JLink Python SDK 依赖 is written only in Chinese, which indicates a language-specific instruction/comment without offering a language choice or documenting a justified locale constraint. This can violate language/locale policy when the skill is expected to be generally usable without forcing a specific language.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is specified as requests>=2.28.0, which allows installation of any later version without reproducibility guarantees. This can introduce vulnerable, incompatible, or unexpected releases during deployment, making supply-chain risk and patch verification harder; in a skill that captures livestreams from devices over network APIs, HTTP client behavior is security-relevant.

Content

Scanner excerpt · scripts/requirements.txt (reported line 3)May include surrounding context.

text

# JLink Python SDK 依赖

requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest uses requests without pinning to a known-safe version, and the package has multiple historical advisories. Because the installed version is not fixed, you cannot verify whether deployments will avoid affected releases, which is a real supply-chain uncertainty; in a device API/livestream capture skill, flaws in HTTP handling could expose credentials, session state, or device data.

Content

No source excerpt is available for this finding.