T09 · Insecure Skill Coding Practices
Error
- Location
scripts/camera_stream.py:377- Finding
Unauthenticated Camera Streaming on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Security audit
linux-camera
Security checks for vulnerabilities and agentic risk
Overview
This camera skill is mostly purpose-aligned, but its streaming server can expose live camera feeds and local files to anyone who can reach the port.
Review carefully before installing. Use this only on trusted machines and networks, avoid starting the streaming server unless you intend to expose the camera feed, do not enable HLS until the path traversal is fixed, and prefer localhost binding plus authentication before any remote viewing.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/camera_stream.py:259- Finding
Arbitrary Local File Disclosure Through HLS Path Traversal
- Content
View full analysis
` and exposes `/hls/` without authentication. 3. An attacker sends an HTTP request that preserves parent-directory components, for example: ```bash curl --path-as-is http://target-host:8090/hls/../../etc/passwd ``` 4. The application computes a path equivalent to: ```text /tmp/camera_hls_/../../etc/passwd ``` 5. `os.path.isfile` succeed ...[truncated 1075 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/camera_stream.py:175- Finding
Execution of an Unpinned Mutable Third-Party HLS Script
- Content
View full analysis
``` ### Technical Analysis The HLS viewer loads and executes the mutable `latest` release of `hls.js` directly from a third-party CDN. No exact package version is selected, and no Subresource Integrity hash is supplied. Consequently, the JavaScript executed by viewers can change after the Skill has been reviewed or installed. A compromised CDN, compromised upstream package release, malicious package maintainer action, or incompatible future update could introduce arbitrary browser-side behavior. TLS protects the network connection but does not ensure that the remote resource remains identical to the version originally reviewed. The absence of a Content Security Policy further weakens containment if the dependency becomes malicious. ### Attack Path 1. The operator starts the camera server with HLS enabled. 2. A viewer opens: ```text http://target-host:8090/hls ``` 3. The browser processes the HLS page and retrieves: ```text https://cdn.jsdelivr.net/npm/hls.js@latest ``` 4. The CDN resolves `latest` to whichever release is current at request time. 5. If the upstream asset or delivery path is compromised, malicious JavaScript executes in the viewer’s browser under the camera server page’s origin. 6. That script can access same-origin camera endpoints, manipulate the displayed stream, and issue requests available to the viewer’s browser context. ### Impact Assessment Successful exploitation affects users who open the HLS viewer page. Malicious dependency code could: - Access same-origin camera snapshots, HLS content, and status data - Alter or replace displayed camera footage - Exfiltrate information available to the page - Perform unauthorized ...[truncated 298 chars]- Remediation
View remediation
/dist/hls.min.js" integrity="sha384-" crossorigin="anonymous"> ``` 3. Prefer vendoring a reviewed copy of the dependency and serving it locally with the Skill. 4. Verify the dependency’s published checksums or signatures during updates. 5. Establish an explicit dependency-update process that includes security review and testing. 6. Add a restrictive Content Security Policy permitting scripts only from the selected trusted source, or only from the local origin when vendoring the library. 7. Avoid inline JavaScript where practical, or authorize it with CSP nonces or hashes rather than enabling broad `unsafe-inline` execution. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code chunk's behavior is narrower than the declared description. It supports recording video clips from V4L2 webcams and RTSP cameras, which aligns with part of the description, but there is no functionality here for taking still photos, enumerating/listing available cameras, or live streaming. The reference to 'Run camera_list.py' is only an error message and does not implement camera listing in this chunk. Therefore the declared description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code chunk is narrowly focused on taking a still image from a local /dev/video* device via ffmpeg with the v4l2 input format. While it does detect whether local video device nodes exist and prints available devices on error, that is only a limited helper behavior rather than a full camera-listing feature. There is no implementation for video recording, streaming, or accessing RTSP/IP camera sources. Therefore, the declared description materially overstates the implemented capabilities in this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description is partially accurate: the code does support Linux cameras, V4L2, ffmpeg, USB webcams, RTSP/IP cameras, snapshots, and live streaming. However, two declared capabilities are not implemented in this code chunk: listing cameras and recording video clips. Instead, the code’s actual primary function is to run a network-accessible live streaming server with snapshot and status endpoints, plus optional HLS and RTSP re-stream output. Because the declared purpose includes significant capabilities absent from the code and understates the server/re-streaming behavior, this is a material description-behavior mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger list contains broad everyday words like 'photo', 'picture', 'video', 'record', and 'stream', which can cause accidental activation in unrelated conversations or tasks. In a camera skill, unintended activation is especially sensitive because it can capture images, record video, or start network streaming without sufficiently deliberate user intent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill describes live streaming endpoints but does not prominently warn users that starting the stream exposes live camera output over HTTP and optionally RTSP to other hosts on the network. This omission is dangerous because users may believe they are only viewing locally while actually publishing camera feeds, potentially leaking private spaces, people, screens, or credentials visible in the frame.
- Content
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
md uv run python scripts/camera_snap.py # Snapshot from a specific camera uv run python scripts/camera_snap.py --device /dev/video2 --output /tmp/photo.jpg # Snapshot from an IP camera uv run python scripts/camera_snap.py --rtsp rtsp://user:pass@192.168.1.100:554/stream1
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
md uv run python scripts/camera_snap.py # Snapshot from a specific camera uv run python scripts/camera_snap.py --device /dev/video2 --output /tmp/photo.jpg # Snapshot from an IP camera uv run python scripts/camera_snap.py --rtsp rtsp://user:pass@192.168.1.100:554/stream1
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
md uv run python scripts/camera_snap.py # Snapshot from a specific camera uv run python scripts/camera_snap.py --device /dev/video2 --output /tmp/photo.jpg # Snapshot from an IP camera uv run python scripts/camera_snap.py --rtsp rtsp://user:pass@192.168.1.100:554/stream1
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
uv run python scripts/camera_snap.py --device /dev/video2 --output /tmp/cam2.jpg
Stream camera 0 on port 8090, camera 2 on port 8091
uv run python scripts/camera_stream.py --device /dev/video0 --port 8090 uv run python scripts/camera_stream.py --device /dev/video2 --port 8091
text
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
uv run python scripts/camera_snap.py --device /dev/video2 --output /tmp/cam2.jpg
Stream camera 0 on port 8090, camera 2 on port 8091
uv run python scripts/camera_stream.py --device /dev/video0 --port 8090 uv run python scripts/camera_stream.py --device /dev/video2 --port 8091
text
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
python source = args.rtsp or args.device threads = [] # MJPEG capture thread (always on) t = threading.Thread( target=capture_mjpeg, args=(args.device, args.rtsp, args.width, args.height, args.fps),
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares use of the exec tool but does not define a restrictive tool scope such as allowed-tools or permissions. Because the skill can invoke shell commands that access cameras, files, and network services, the missing scope increases the chance of unintended or overbroad command execution.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Dependencies
bash sudo apt-get install -y ffmpeg v4l-utilsScripts
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] print(f"Recording {duration}s from {device} ({width}x{height} @ {fps}fps)...") result = subprocess.run(cmd, capture_output=True, text=True, timeout=duration + 30) if result.returncode != 0: print(f"ffmpeg error:\n{result.stderr}", file=sys.stderr)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] print(f"Recording {duration}s from {device} ({width}x{height} @ {fps}fps)...") result = subprocess.run(cmd, capture_output=True, text=True, timeout=duration + 30) if result.returncode != 0: print(f"ffmpeg error:\n{result.stderr}", file=sys.stderr)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python info = {"path": str(dev), "name": "", "driver": "", "formats": []} try: result = subprocess.run( ["v4l2-ctl", "--device", str(dev), "--info"], capture_output=True, text=True, timeout=5, )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python pass try: result = subprocess.run( ["v4l2-ctl", "--device", str(dev), "--list-formats-ext"], capture_output=True, text=True, timeout=5, )
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python if not devices: print("No video capture devices found.", file=sys.stderr) print("Make sure a camera is connected and v4l-utils is installed:") print(" sudo apt-get install -y v4l-utils") sys.exit(1) if args.json:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This skill captures images from a camera and writes them to disk, but the user-facing description and usage text do not provide any privacy warning, consent cue, or prominent notice that local image files will be created. In a camera skill, this increases the risk of unnoticed collection or retention of sensitive visual data, especially if triggered by broad phrases like 'photo', 'snapshot', or 'webcam'.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] print(f"Taking photo from {device}...") result = subprocess.run(cmd, capture_output=True, text=True, timeout=15) if result.returncode != 0: print(f"Error: {result.stderr.strip()}", file=sys.stderr)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] print(f"Capturing from {device} ({width}x{height}, warmup={warmup_frames} frames)...") result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode != 0: print(f"ffmpeg error:\n{result.stderr}", file=sys.stderr)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] print(f"Capturing from {device} ({width}x{height}, warmup={warmup_frames} frames)...") result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode != 0: print(f"ffmpeg error:\n{result.stderr}", file=sys.stderr)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
When an RTSP URL is supplied, the script causes ffmpeg to connect to a network camera without any explicit warning about outbound network access, possible credential exposure in URLs, or privacy implications of capturing from remote streams. In a camera-capture skill, this behavior is functionally expected, but the lack of disclosure can still surprise users and lead to accidental transmission of sensitive camera endpoint information or use of embedded credentials.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "pipe:1", ] proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE) buf = b"" try:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python playlist, ] proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE) try: while server_running:
Static analysis
No suspicious patterns detected.