ClawHub
Back to skill

Security audit

H test

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Ezviz camera inspection tool that sends configured restaurant camera snapshots to Ezviz services for AI analysis, with privacy and credential risks users should manage.

Install only if you are authorized to send the relevant camera images to Ezviz cloud analysis. Use least-privilege Ezviz credentials, prefer environment variables or a secret manager over command-line secrets, verify employee/customer privacy obligations, and avoid using it on cameras or areas where cloud processing is not permitted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends a captured image URL and inspection prompt to an external AI analysis service without any explicit consent flow, warning, or configurable privacy control. In a restaurant or kitchen setting, images may contain employees, customers, operational details, or other sensitive business information, so silent transmission creates a real privacy and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
**AI 智能体分析接口调用格式**:

```bash
curl --location --request POST 'https://aidialoggw.ys7.com/api/service/open/intelligent/agent/engine/agent/anaylsis' \
--header 'accessToken: YOUR_ACCESS_TOKEN' \
--header 'Content-Type: application/json' \
--data-raw '{
Confidence
87% confidence
Finding
The skill sends sensitive operational data, including image URLs and access-token-authenticated requests, to external cloud endpoints for analysis. Although this is part of the documented feature set and the endpoints appear to be the vendor's official services, it is still a real data-exposure surface because camera imagery from kitchens or dining areas may contain sensitive personal or business information.

Static analysis

No suspicious patterns detected.