Security audit

pet-camera-vision

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it captures camera images and infers face presence and emotion without clear consent, retention, or deletion controls.

Install only if you are comfortable with a skill that can take camera snapshots, analyze faces/emotions, save images locally, and pass derived emotion state into memory or feedback flows. Before using it around other people, add explicit consent/enablement, visible capture indication, retention/deletion rules, and a way to disable or run without storing raw images.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documentation indicates capabilities to read environment variables, access files, and invoke shell-based camera backends, but no explicit permission declaration is present. For a camera/emotion-analysis skill, undeclared capability scope reduces transparency and can cause the host or user to approve a skill without understanding that it will access local devices, write images to disk, and execute external binaries.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This skill captures camera images, infers facial presence and emotion, and feeds outputs into memory/companion feedback flows, yet the documentation lacks a clear privacy warning, consent expectations, retention policy, or notice about sensitive biometric/affective processing. In context, this is more dangerous because the skill is intended for ongoing ambient observation and memory integration, which can normalize persistent collection of highly sensitive personal data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script captures and stores images from a camera without any built-in user-facing notice, consent check, or recording indicator. In a pet-camera/companion context, this creates a real privacy risk because visual data collection can occur silently and may capture people, surroundings, or sensitive information unintentionally.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The demo explicitly instructs users to capture camera images and infer presence, emotion, and appearance attributes, but it provides no privacy notice, consent guidance, retention policy, or warning about biometric/sensitive personal data handling. In this skill context, the omission is more serious because the output is intended for memory updates and companion feedback, which increases the chance of persistent storage and secondary use of user imagery and inferred emotional state.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The prompt describes capturing camera screenshots and analyzing faces, emotions, and presence, but it provides no user-facing notice, consent flow, or privacy guidance. In a companion/pet-camera context, this can enable covert collection and inference of sensitive biometric and emotional data, especially because the output is intended for memory and feedback modules.

Static analysis

No suspicious patterns detected.