My Camera API

通过本地 CLI 查询 TIVS 设备相关信息。包括设备列表，设备截图等能力。用户提出摄像头等设备查询查看需求时使用。

Security Scan

The skill's declared metadata does not match its runtime instructions: SKILL.md requires TIVS credentials and running a local Node CLI (which can write credentials to disk), but the registry metadata lists no required env vars or binaries — this mismatch and the included CLI file warrant caution.

Purpose & Capability

The description says this is a local CLI for querying TIVS camera devices, which plausibly needs TIVS credentials and a Node runtime. However the registry metadata declares no required env vars and no required binaries while SKILL.md explicitly requires TIVS_APP_ID and TIVS_AUTHORIZATION and tells the agent to run `node ./tivs-cli.js`. The metadata omission is inconsistent and unexplained.

Instruction Scope

SKILL.md instructs the agent to cd into the skill directory, auto-load a local .env, and perform an interactive `login` command that will write access_token, TIVS_AUTHORIZATION and TIVS_APP_ID into a `.env` file in the skill folder. Writing credentials to disk in the skill directory and auto-loading them is beyond a simple read-only query operation and may persist sensitive tokens on disk. The instructions also say to download screenshots and 'use sending image capability' (i.e., transmit image content to the user), which means the skill will read local files and transmit binary data — acceptable for a camera tool but worth noting.

Install Mechanism

There is no install spec (instruction-only), but the package includes a large JS CLI file (tivs-cli.js). That file will be executed by `node` per the instructions. No provenance, release host, or install sandbox is provided — running bundled, unsigned JS from an unknown source increases risk even if no external installer is declared.

Credentials

SKILL.md requires TIVS_APP_ID and TIVS_AUTHORIZATION (and optionally TIVS_PROVIDER) but the skill's declared required env vars and primary credential are empty — this is a mismatch. The CLI's described behavior (interactive login that writes these values into a local `.env`) stores credentials in clear in the skill folder rather than using a secure credential store; that is disproportionate and increases exposure. No justification is given for other possible environment accesses.

Persistence & Privilege

The skill is not always-enabled (always:false) and allows normal autonomous invocation. However the skill's login flow persists tokens to the skill folder's `.env`, granting ongoing local persistence of credentials; this persistence is implemented by the skill itself and could remain after uninstall unless removed manually.

Scan Findings in Context

[system-prompt-override] unexpected: A pre-scan flagged 'system-prompt-override' patterns in SKILL.md. The visible SKILL.md content contains strict runtime directives (cd into skill folder, auto-load .env, write .env) that could be used to influence agent behavior. This is unexpected for a simple camera-query skill and should be reviewed; it may be a benign instruction about workspace layout but could also indicate an attempt to inject controlling instructions.

What to consider before installing

Do not enable this skill without reviewing its code and behavior. Specific actions to take before installing: 1) Inspect tivs-cli.js for all network endpoints it contacts (where tokens and images are sent), and verify it only talks to legitimate TIVS servers. 2) Confirm how the login command writes `.env` (location, format, permissions) and avoid storing sensitive credentials in a public/unencrypted folder; prefer using a secure credential store instead. 3) Note the skill requires a Node runtime even though metadata doesn't declare it — run it in a sandbox or VM first. 4) If you must use it, run the CLI interactively in an isolated environment, do not reuse high-privilege credentials, and delete the `.env` after use. If you can, ask the publisher for authoritative metadata (declared env vars and provenance of the CLI) and a signed release or a minimal audit of network requests; absence of that information keeps the risk level elevated.

My Camera API Skill

作用

当用户需要查询 TIVS 设备相关信息时，使用这个技能。

通用约定

• [必须按此操作] 先进入当前 skill 目录，例如 cd xxx/skills/camera-api，再执行 tivs-cli.js
• 默认自动加载当前技能目录下的 .env 环境变量
• 优先使用 JSON 输出
• 先解析结构化结果，再向用户总结
• 所需环境变量：TIVS_APP_ID、TIVS_AUTHORIZATION、可选 TIVS_PROVIDER

能力清单

登录

• 命令：node ./tivs-cli.js login skill --app icam365
• 用途：通过终端交互式登录tivs账号，保存登录凭证
• 详细说明：交互登录并获取 access_token，自动写入当前文件夹的.env文件，保存TIVS_AUTHORIZATION和TIVS_APP_ID环境变量

设备列表

• 命令：node ./tivs-cli.js devices list --json
• 用途：获取当前账号下的设备列表

设备截图

• 命令：node ./tivs-cli.js devices screenshot <deviceId> --json
• 用途：查询指定设备的截图记录，返回截图时间和图片地址
• 附加说明：优先取 items[0] 作为最新一条截图记录
• 附加说明：使用该记录的 imagePath 下载截图，并优先用发送图片能力把截图发给用户，不要只返回链接让用户点开

通用流程

1. 判断用户要查询的是设备列表、设备事件还是设备截图
2. 选择对应命令并优先使用 JSON 输出
3. 解析结果并提炼关键信息
4. 向用户返回简洁结论

异常处理

• 缺少认证变量时，提示补充 TIVS_APP_ID 和 TIVS_AUTHORIZATION
• CLI 或 API 报错时，直接返回错误信息
• 无结果时，明确说明未查询到数据
• 截图列表为空时，明确说明该设备暂无截图记录
• 截图下载失败时，返回最近一条截图的时间和链接，并说明下载失败