Security audit

ESP32-CAM Eyes

Security checks for vulnerabilities and agentic risk

Overview

The skill is documentation-only and aligned with setting up ESP32 cameras, but it guides users to expose live camera images without authentication and with a predictable fallback Wi-Fi access point.

Install only if you are prepared to secure the device yourself. Use a dedicated IoT or isolated network, do not port-forward the camera, remove wildcard CORS unless needed, add authentication or restrict access to trusted clients, replace the fallback AP credentials with a unique strong secret or disable AP fallback, and avoid storing real Wi-Fi credentials in shared source code.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: references/setup-guide.md:231
Finding: Unauthenticated Plaintext Access to Camera Images and Live Streams
Content: View full analysis
/capture` to retrieve snapshots or `http:///stream` to receive a live video stream. 5. The server returns camera imagery without requesting credentials. 6. If the attacker can monitor local traffic, plaintext imagery may also be passively intercepted. ### Impact Assessment Any network-reachable attacker can obtain camera snapshots and continuous video. This can result in unauthorized surveillance and disclosure of people, physical locations, documents, screens, possessions, ...[truncated 234 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/setup-guide.md:162
Finding: Wildcard CORS Policy Permits Cross-Origin Retrieval of Camera Snapshots
Content: View full analysis
format == PIXFORMAT_JPEG) { httpd_resp_set_type(req, "image/jpeg"); httpd_resp_set_hdr(req, "Access-Control-Allow-Origin", "*"); esp_err_t res = httpd_resp_send(req, (const char *)fb->buf, fb->len); ``` ```cpp if (ok) { httpd_resp_set_type(req, "image/jpeg"); httpd_resp_set_hdr(req, "Access-Control-Allow-Origin", "*"); esp_err_t res = httpd_resp_send(req, (const char *)jpg_buf, jpg_len); ``` ### Technical Analysis Both successful paths in the snapshot handler return `Access-Control-Allow-Origin: *`. This permits JavaScript executing under any web origin to read snapshot responses when the browser can reach the ESP32. The policy is especially dangerous when combined with the absence of endpoint authentication. A malicious website can attempt requests to common private-network addresses and, where browser private-network controls do not prevent the request, read camera images directly. ### Attack Path 1. The victim's browser is connected to a network from which the ESP32 camera is reachable. 2. The victim visits an attacker-controlled website. 3. JavaScript on that website probes a known, guessed, or previously discovered camera address. 4. The script requests `http:///capture`. 5. The ESP32 returns the image with `Access-Control-Allow-Origin: *`. 6. The browser allows the attacker's JavaScript to read and transmit the image, subject to the browser's applicable mixed-content and private-network access restrictions. ### Impact Assessment A hostile website may retrieve and exfiltrate snapshots through a victim's browser without requiring direct attacker membership in the local network. The practical scope depends on browser network protections and knowledge of the device address, but successful ...[truncated 141 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/setup-guide.md:304
Finding: Fallback Access Point Uses a Globally Predictable Password
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/setup-guide.md:131
Finding: Wi-Fi Credentials Are Embedded Directly in Source Code and Firmware
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/setup-guide.md:59
Finding: Unpinned Python Dependencies Are Installed Into the System Environment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to deploy an HTTP camera server exposing /capture and /stream, but it does not warn that these endpoints make live images available to any device on the local network unless additional controls are added. This can lead to unintended surveillance exposure, privacy leakage, and easy access by other systems on the same WiFi, especially in home or shared-network environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The HTTP server registers /capture and /stream endpoints with no authentication, authorization, or transport protection. Any host on the same network—or any client connected to the fallback AP—can retrieve snapshots or live video, which is especially sensitive because this skill is specifically for giving agents physical vision. The added CORS wildcard also broadens access from browser-based clients.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The firmware falls back to AP mode with a hardcoded, predictable SSID and password, then immediately starts the camera server. Anyone within radio range who knows or guesses the default credentials can join and access the device, and the fixed password is weak because it is reused across deployments. In the context of a camera sensor, this creates direct privacy and surveillance exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The fallback AP uses a predictable network name and documented default password without warning users that nearby parties may connect and view the camera feed. Because this is a visual sensor deployment guide, the omission is more dangerous than for a generic embedded demo: it can expose live images from physical environments to anyone in range. The problem is compounded by the unauthenticated HTTP camera service started in AP mode.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly instructs users to expose capture and live-stream endpoints on the LAN without any accompanying warning about privacy, consent, or network trust assumptions. While documentation alone is not code execution, here it operationalizes insecure deployment of a camera, making accidental surveillance exposure more likely. In this skill context, omission of security guidance materially increases risk.
Content: No source excerpt is available for this finding.