Camsnap

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real webcam snapshot utility, but its claimed path protection is not enforced, so it can save or overwrite image files outside the expected folder if given such a path.

Review before installing. Use this only when you are comfortable granting webcam access and saving camera images locally. Avoid passing untrusted output_path or output_dir values, especially absolute paths or paths containing '..'. A safer version should enforce a dedicated snapshot directory, reject escapes after path resolution, and avoid overwriting existing files unless explicitly requested.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: camsnap.py:22

Finding

Unrestricted Output Path Allows Arbitrary Image File Writes

Content

View full analysis

Vulnerability Details

File Location: camsnap.py, lines 22–28 and 50–53
Vulnerability Type: Improper path restriction and arbitrary file write
Risk Level: Medium

Vulnerable Code:

python

def _validate_output_path(path: str) -> Path:
    """Validate and normalize an output path, guarding against traversal and bad extensions."""
    resolved = Path(path).resolve()
    ext = resolved.suffix.lower()
    if ext and ext not in _ALLOWED_EXTENSIONS:
        raise ValueError(f"Unsupported image extension: {ext!r}. Allowed: {sorted(_ALLOWED_EXTENSIONS)}")
    return resolved

python

if output_path:
    dest = _validate_output_path(output_path)
    dest.parent.mkdir(parents=True, exist_ok=True)

The resulting destination is subsequently passed to:

python

success = cv2.imwrite(str(dest), frame)

Technical Analysis

_validate_output_path() canonicalizes the supplied path with Path.resolve(), but canonicalization does not enforce a filesystem boundary. There is no trusted root directory against which the resolved destination is checked.

Consequently, absolute paths and relative traversal paths such as ../../outside/snapshot.jpg are accepted as long as their suffix is in the image-extension allowlist. The extension check does not prevent writing outside the intended snapshot directory. In addition, dest.parent.mkdir(parents=True, exist_ok=True) creates attacker-selected parent directories before the image is written.

This behavior contradicts the documented path-traversal protection. Exploitation requires control over the positional output_path argument or equivalent access to the module API.

Attack Path

1. An attacker or untrusted caller supplies an absolute destination or a traversal path, such as ../../target/location/image.jpg.
2. _validate_output_path() resolves the input to an absolute path.
3. The function validates only the filename extension ...[truncated 909 chars]

Remediation

View remediation

Remediation Suggestions

Define an explicit trusted output root and require every destination to remain within it after canonicalization. Reject absolute user paths and any relative path that escapes the root. Perform validation before creating directories or writing files.

For example:

python

def _validate_output_path(path: str, output_dir: str) -> Path:
    root = Path(output_dir).resolve(strict=False)
    supplied = Path(path)

    if supplied.is_absolute():
        raise ValueError("Absolute output paths are not allowed")

    dest = (root / supplied).resolve(strict=False)

    if not dest.is_relative_to(root):
        raise ValueError("Output path escapes the permitted directory")

    if dest.suffix.lower() not in _ALLOWED_EXTENSIONS:
        raise ValueError("Unsupported image extension")

    return dest

Additional hardening should include:

• Apply the same trusted-root policy consistently to CLI and module callers.
• Require a valid extension rather than permitting an empty suffix.
• Refuse to overwrite existing files unless overwrite behavior is explicitly requested.
• Consider rejecting symlinked parent components or opening output files with exclusive creation semantics where feasible.
• Create directories only after all containment and file-type checks succeed.
• Add tests for absolute paths, .. traversal, nested traversal, symlink escapes, unsupported or missing extensions, and existing destinations.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill metadata and documentation explicitly claim path traversal protection and directory restriction, but the finding states the implementation does not actually enforce those guarantees. This is dangerous because agents or users may rely on the documented safety boundary and permit untrusted path input, potentially allowing writes outside the intended directory or overwriting unintended files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function claims to guard against path traversal and out-of-bounds writes, but it only resolves the supplied path and checks the file extension. An attacker-controlled caller can still provide an absolute or traversal-based path that resolves anywhere writable on the filesystem, causing unauthorized file creation or overwrite if this skill is exposed through an agent or service boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The public API documentation states that traversal outside allowed directories is rejected, but the implementation defines no allowed-directory policy and will write to any resolved path with an approved image extension. In agent contexts, this mismatch is dangerous because integrators may trust the documented safety guarantee and pass through user-controlled paths, enabling arbitrary file writes within the process's permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.