T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:317- Finding
Authentication Credentials Can Be Forwarded to Arbitrary Absolute URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
生命涌现设备管理
Security checks for vulnerabilities and agentic risk
Overview
This camera-management skill has real device-control functionality, but it under-discloses sensitive account, stream, credential, and face-analysis data handling that users should review before installing.
Install only if you accept that this skill can contact external Life Emergence/Open API services, manage and control registered cameras, expose stream links, create or reuse an account from your OpenClaw identity, and store tokens locally. Treat it as needing review or remediation before normal use: remove or separate the face-analysis component, require explicit consent for account creation and media uploads, avoid HTTP/query-string playback secrets, redact logs, and store credentials in a proper secret store.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:370- Finding
Raw Authentication Headers Are Exposed in Success and Error Logs
- Content
View full analysis
30: safe_headers[k] = v[:20] + "..." else: safe_headers[k] = v print( f"🔄 请求拦截, URL:{url}", "method", method, "params", params, "data", data, "headers", safe_headers, "options", options, "timeout", timeout ) # ... print( f"✅ 请求拦截, 成功:{response_text}, url:{url}", "method", method, "params", params, "data", data, "headers", headers, "timeout", timeout ) ``` The exception path also logs request context without consistently applying the `safe_headers` redaction object. ### Technical Analysis The pre-request diagnostic creates a partially masked `safe_headers` dictionary. However, the success path prints the original `headers` object, which contains: - `X-Access-Token`; - `X-Api-Key`; - `Authorization`. Therefore, the attempted redaction does not protect credentials after a successful request. The error-handling path similarly risks exposing sensitive request context. In addition, the initial masking still exposes the first 20 characters of long secrets, which is unnecessary and may aid token identification or correlation. Request data and parameters are also logged without field-level filtering, potentially exposing account identifiers, camera serial numbers, connection information, and other sensitive values. ### Attack Path 1. A user performs any operation that invokes the shared request helper, such as listing devices. 2. Authentication tokens are loaded or created and attached to the request headers. 3. The cloud request succeeds or encounters an ...[truncated 712 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/dao.py:62- Finding
Cloud Authentication Tokens Are Stored Unencrypted in a Workspace-Wide SQLite Database
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api_service.py:33- Finding
Camera Playback Tokens and Connection Strings Are Exposed in Plain-HTTP URLs
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skills/smyx_common/scripts/util.py:296- Finding
Environment-Derived Sender Identifiers Are Silently Used for Remote Account Registration
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skills/face_analysis/scripts/skill.py:102- Finding
Bundled Face-Analysis Component Can Upload Local Biometric Media Outside the Declared Device-Management Scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/device_management.py:98- Finding
Device Login Credentials Can Be Persisted in Plaintext YAML
- Content
View full analysis
Dict: config = load_config() if "devices" not in config: config["devices"] = [] device = { "id": generate_device_id(), "name": name, "type": type, "ip": ip, "username": username, "password": password, "status": "online", "created_at": datetime.now().isoformat(), "updated_at": datetime.now().isoformat(), **kwargs } config["devices"].append(device) save_config(config) return device ``` The save operation at `scripts/device_management.py:61-64` writes the structure directly to YAML: ```python def save_config(config: Dict) -> None: with open(CONFIG_PATH, "w", encoding="utf-8") as f: yaml.dump( config, f, default_flow_style=False, allow_unicode=True ) ``` ### Technical Analysis The local `add_device()` implementation includes the username and password directly in the device dictionary, then serializes the dictionary into a YAML file without encryption. This contradicts the top-level documentation, which claims device passwords are encrypted and not exposed in plaintext. YAML serialization provides no confidentiality. The active cloud registration branch in `main()` does not currently call this local helper, but the function remains callable by imports, tests, integrations, or future command-path changes. Its presence creates an unsafe credential-storage path. ### Attack Path 1. A caller invokes `add_device()` with a device username and password. 2. The credentials are inserted directly into ...[truncated 735 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (130)
Known Vulnerable Dependency: Authlib==1.6.6 — 14 advisory(ies): CVE-2026-28490 (Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle); CVE-2026-28802 (Authlib: Setting `alg: none` and a blank signature appears to bypass signature v); CVE-2026-41425 (Authlib: Cross-site request forging when using cache) +11 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The requirements pin Authlib to 1.6.6, and the supplied advisories include critical issues affecting JWT/JWE/OAuth flows such as signature bypass and padding-oracle style attacks. In a device-management skill that may expose authenticated APIs, stream URLs, or camera controls, weaknesses in auth and token handling materially increase the risk of account takeover, token forgery, or unauthorized device access.
- Content
Known Vulnerable Dependency: GitPython==3.1.45 — 16 advisory(ies): CVE-2026-78676 (GitPython: Dormant multi-line git-config values are corrupted into live injected); CVE-2026-67325 (GitPython: Command Injection via git long-option prefix abbreviation bypass of C); CVE-2026-73620 (GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagRefere) +13 more
Critical
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
GitPython 3.1.45 is flagged with multiple critical advisories including command injection and unsafe option forwarding. If the skill or its supporting tooling interacts with repositories, branches, tags, or checkout paths derived from user or agent-controlled input, this can lead to arbitrary command execution or repository manipulation.
- Content
Known Vulnerable Dependency: langchain-core==1.0.2 — 12 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa); CVE-2026-40087 (LangChain has incomplete f-string validation in prompt templates) +9 more
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
langchain-core 1.0.2 has multiple critical advisories including SSRF and template injection style issues. Because this skill appears to be an LLM-enabled device-management integration, SSRF could be especially dangerous by enabling access to internal device endpoints, metadata services, or private stream URLs, while template injection can subvert prompt or tool behavior.
- Content
Known Vulnerable Dependency: Authlib==1.6.6 — 14 advisory(ies): CVE-2026-28490 (Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle); CVE-2026-28802 (Authlib: Setting `alg: none` and a blank signature appears to bypass signature v); CVE-2026-41425 (Authlib: Cross-site request forging when using cache) +11 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The requirements file pins Authlib to a version flagged by multiple advisories, including severe JWT/JWE validation and CSRF-related issues. In a device-management skill that may handle authentication, tokens, and live stream access, vulnerable auth libraries materially increase the risk of account compromise, token forgery, or unauthorized device access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding points to automatic login/token acquisition, token persistence, file writes, and generic HTTP wrappers beyond the user-facing description. In a device-control skill, silent authentication material handling and persistence are sensitive because they can expand access, enable cross-user confusion, and create durable secrets on disk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to execute device-listing commands automatically when keywords appear removes a key human-approval checkpoint. Because device inventories and stream access are sensitive surveillance data, automatic execution materially increases the risk of data disclosure and unintended actions from ambiguous or injected prompts.
- Content
Known Vulnerable Dependency: click==8.3.1 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
If click 8.3.1 is affected by a command-injection vulnerability as indicated, any administrative tooling, deployment script, or maintenance command that passes untrusted input into Click-backed commands could become an execution vector. Even though this is a requirements file and exploitation depends on how the package is used, device-management environments often include operational scripts where command execution impact is significant.
- Content
Known Vulnerable Dependency: cryptography==3.4.8 — 16 advisory(ies): CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +13 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
cryptography 3.4.8 is an old security-sensitive package version with multiple advisories, including oracle and bundled OpenSSL issues. In a system handling HTTPS, tokens, certificates, or signed device-control traffic, weaknesses in cryptographic primitives or linked libraries can undermine confidentiality and authentication guarantees.
- Content
Known Vulnerable Dependency: httplib2==0.20.2 — 2 advisory(ies): CVE-2026-59939 (httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Respon); CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, htt)
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
httplib2 0.20.2 is reported vulnerable to decompression-bomb denial of service via unbounded compressed responses. In a service that may fetch remote resources such as stream metadata, auth endpoints, or third-party APIs, an attacker-controlled endpoint could trigger memory or CPU exhaustion.
- Content
Known Vulnerable Dependency: idna==3.11 — 2 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA) for Python provides suppor)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The dependency list includes idna 3.11 with reported security issues in handling crafted internationalized domain inputs. If this application accepts or constructs URLs for camera endpoints, callback hosts, or external integrations, IDNA parsing ambiguities could contribute to SSRF, validation bypass, or hostname confusion.
- Content
Known Vulnerable Dependency: langchain-openai==1.0.1 — 2 advisory(ies): GHSA-r7w7-9xr2-qq2r; PYSEC-2026-76
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
langchain-openai 1.0.1 is reported with security advisories, and as a bridge between the application and model/tooling stack it can amplify prompt-injection, data-exfiltration, or unsafe request-processing issues. In this skill context, compromised model integration could expose camera metadata, device identifiers, or internal endpoints.
- Content
Known Vulnerable Dependency: langgraph==1.0.2 — 2 advisory(ies): GHSA-g48c-2wqr-h844; PYSEC-2026-83
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
langgraph 1.0.2 is flagged by advisories affecting the agent workflow layer. Since agent graphs orchestrate tool calling and state transitions, vulnerabilities here can lead to unauthorized tool execution, state corruption, or leakage of device-management context in a system that may control or disclose surveillance resources.
- Content
Known Vulnerable Dependency: langgraph-checkpoint==3.0.0 — 4 advisory(ies): GHSA-fjqc-hq36-qh5p; GHSA-mhr3-j7m5-c7c9; PYSEC-2026-2573 +1 more
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
langgraph-checkpoint 3.0.0 has multiple advisories, and checkpoint/state persistence vulnerabilities can expose or corrupt conversational and tool state. In a device-management skill, persisted state may include device identifiers, stream URLs, auth material, or prior tool outputs that should not be disclosed or tampered with.
- Content