ClawHub
Back to skill

Security audit

jftech-open-pro-ptz-control

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed command-line tool for controlling JF PTZ cameras, with expected credential and network use for that purpose.

Install only if you intend to let the agent control the specified JF camera. Use dedicated credentials if possible, verify JF_ENDPOINT before running, and require explicit confirmation for actions that move the camera, enable masking, delete presets, or change tours.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares use of environment variables and network endpoints, but the static finding indicates it lacks a corresponding explicit permissions declaration. This creates a transparency and governance gap: a platform or reviewer may not correctly understand that the skill can access secrets and make outbound API calls, which can weaken consent, auditing, and policy enforcement.

Static analysis

No suspicious patterns detected.