ClawHub
Back to skill

Security audit

Frigate MQTT Camera Monitor and Notifier

Security checks for vulnerabilities and agentic risk

Overview

This notifier has a coherent purpose, but it handles camera images, SMTP credentials, outbound messages, and a long-running listener with under-scoped security controls.

Install only if you can harden the deployment: use authenticated TLS MQTT with broker ACLs, HTTPS for Frigate, required SMTP TLS or app-specific credentials, owner-only permissions or a secret store for config.json, a dedicated unprivileged service account, and validation of event IDs plus safe temporary-file handling before enabling attachments or background operation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
frigate_notifier.py:58
Finding

Untrusted MQTT Event ID Enables Unsafe Temporary-File Access

Content
View full analysis
1024: send_email_notification(f"Frigate Alert: {display_name} on {camera}", f"Detection captured on {camera}.", snapshot_path) else: send_email_notification(f"Frigate Alert (Low Res): {display_name} on {camera}", "Photo was too low quality.") else: send_email_notification(f"Frigate Alert (API Error): {display_name} on {camera}", f"API error {response.status_code}.") if os.path.exists(snapshot_path ...[truncated 2204 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
frigate_notifier.py:106
Finding

MQTT Control Channel Lacks Authentication and Transport Encryption

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
email_dispatcher.py:39
Finding

Configuration Permits Plaintext Transmission of Surveillance Data and SMTP Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation instructs users to place SMTP credentials, including the password, directly into a local JSON configuration file and provides no warning about secret storage, file permissions, or safer alternatives. This increases the likelihood of credential exposure through backups, logs, source control, or multi-user hosts, especially because the same document also recommends running the service persistently on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
### 3. Deployment
Run the notifier in the background:
`nohup python3 frigate_notifier.py > frigate_notifier.log 2>&1 &`

## 📖 How it Works
The skill subscribes to the `frigate/events` topic. When a detection occurs, it resolves the identity, checks the rate limit, fetches the best available image from the API, and dispatches the alerts.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This script sends arbitrary message content and optional file attachments to an external email recipient with no confirmation, policy check, recipient allowlist, or data classification guardrail. In an agent/skill context, that creates a clear exfiltration path for sensitive local data because user- or tool-supplied attachment paths can be transmitted off-system with minimal friction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill invokes external commands to send WhatsApp messages and email notifications, including optional media attachments, but provides no confirmation prompt or user-facing disclosure that external messaging actions will occur. While error prints exist, they do not warn the user beforehand about outbound notifications or attachment sending, which is a safety-relevant behavior in code files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · frigate_notifier.py (reported line 41)May include surrounding context.

python
cmd = ["openclaw", "message", "send", "--channel", "whatsapp", "--target", USER_TARGET_WA, "--message", message]
        if media_path:
            cmd.extend(["--media", media_path])
        subprocess.run(cmd, check=True)
    except Exception as e:
        print(f"WhatsApp error: {e}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
84% confidence
Finding

This subprocess launches a relative script name (email_dispatcher.py) via python3, which creates an execution-path trust issue: if the working directory is attacker-controlled or the file can be replaced, arbitrary code could run. The attachment_path is also passed through to another script without local validation, increasing risk if that downstream script handles paths unsafely.

Content

Scanner excerpt · frigate_notifier.py (reported line 51)May include surrounding context.

python
cmd = ["python3", "email_dispatcher.py", "--to", USER_TARGET_EMAIL, "--subject", subject, "--body", body]
        if attachment_path:
            cmd.extend(["--attachment", attachment_path])
        subprocess.run(cmd, check=True)
    except Exception as e:
        print(f"Email error: {e}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code constructs a snapshot URL containing the Frigate event ID and performs an HTTP request to retrieve event imagery, but there is no confirmation prompt, user-facing log, or comment/docstring disclosing that detection data and images are fetched over the network. For a code file, network operations involving potentially sensitive camera-event data should have some visible warning unless explicitly documented as part of the skill's stated purpose, which is not present in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.