Fing Local API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

The skill is a mostly coherent read-only Fing helper, but it exposes sensitive home-network and presence data with weak scoping and plaintext credential transport risks that users should review before installing.

Install only if you are comfortable giving the agent access to Fing device inventory and household presence information. Prefer localhost or an encrypted tunnel, avoid passing the API key on the command line, protect any workspace .env file, and treat people/presence output as sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fing_helper.py:40

Finding

Fing API credentials and private network data may be transmitted over plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/fing_helper.py, lines 40-42, 123-127, and 137
Vulnerability Type: Plaintext transmission of sensitive information
Risk Level: Medium

Vulnerable Code

python

def request_json(base_url: str, endpoint: str, api_key: str) -> dict[str, Any]:
    params = urllib.parse.urlencode({"auth": api_key})
    url = f"{base_url}/1/{endpoint}?{params}"
    safe_url = f"{base_url}/1/{endpoint}?auth=***"

python

parser.add_argument("--host", default=os.getenv("FING_API_HOST", "localhost"))
parser.add_argument("--port", default=os.getenv("FING_API_PORT", "49090"))
parser.add_argument("--scheme", default=os.getenv("FING_API_SCHEME", "http"), choices=["http", "https"])
parser.add_argument("--api-key", default=os.getenv("FING_API_KEY"), help="Fing API key; defaults to FING_API_KEY")
parser.add_argument("--raw", action="store_true", help="Print raw API response wrapper")
sub = parser.add_subparsers(dest="command", required=True)
sub.add_parser("devices", help="List all discovered devices")
sub.add_parser("people", help="List Fing Desktop contacts/presence; may be unsupported on Fing Agent/Fingbox")
sub.add_parser("summary", help="Compact health/device summary")

args = parser.parse_args()
if not args.api_key:
    die("Missing API key. Set FING_API_KEY or pass --api-key.")
base_url = f"{args.scheme}://{args.host}:{args.port}"

if args.command == "devices":
    result = request_json(base_url, "devices", args.api_key)

Technical Analysis

The helper places the Fing API key in the auth URL query parameter and uses http as its default transport scheme. Although the documented Fing Local API itself specifies query-string authentication over local HTTP, the helper also permits the host to be changed from loopback to an arbitrary LAN hostname or IP address.

When used with a non-loopback host and the default scheme, the API key, request path, a ...[truncated 2538 chars]

Remediation

View remediation

Remediation Suggestions

1. Require HTTPS for non-loopback hosts whenever the Fing deployment supports TLS.
2. Detect loopback addresses and refuse plaintext HTTP for other destinations by default.
3. If upstream Fing agents only support HTTP, require an explicit option such as --allow-insecure-http before contacting a non-loopback host and emit a clear warning about credential and inventory exposure.
4. Recommend a trusted encrypted tunnel, VPN, or local TLS reverse proxy for remote LAN access where native HTTPS is unavailable.
5. Prefer an authorization header instead of a query parameter if a future Fing API version supports it. Until then, continue masking the key and document that intermediary and server URL logs may retain it.
6. Avoid accepting --api-key on the command line where practical because process listings and shell history may expose it. Prefer FING_API_KEY from a suitably protected environment or secret store.
7. Validate or constrain configured destinations where operationally possible, and document that arbitrary remote hosts receive the supplied API key.
8. Rotate the Fing API key if plaintext traffic may have crossed an untrusted network.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fing_helper.py (reported line 131)May include surrounding context.

python

def main() -> None:
    load_env_file(os.path.join(os.getcwd(), ".env"))
    parser = argparse.ArgumentParser(description="Read-only Fing Local API helper")
    parser.add_argument("--host", default=os.getenv("FING_API_HOST", "localhost"))
    parser.add_argument("--port", default=os.getenv("FING_API_PORT", "49090"))

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a local Python helper, consumes environment variables including an API key, reads a workspace .env file, and performs network access to a local HTTP API, but it does not declare any explicit tool scope or permissions boundary. That mismatch creates a trust and review gap: an agent or operator may approve the skill without realizing it can access secrets, local files, and network resources, increasing the chance of unintended data exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The helper fetches and prints people-presence data, including display names and online/offline state, without any consent check, warning, minimization, or access control in the tool itself. In this skill’s context, presence data is privacy-sensitive household telemetry, so exposing it through a general-purpose helper increases the risk of unauthorized monitoring or accidental disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.