Security audit

CamSnap

Security checks for vulnerabilities and agentic risk

Overview

This package presents itself as a camera-monitoring skill, but the shipped local tooling is mostly release and auto-publishing automation rather than camera functionality.

Review this package carefully before installing. It does not appear to provide the advertised camera command implementation, and the included helper scripts are focused on publishing the skill to ClawHub. Do not symlink `scripts/camsnap`, install the git hook, or run the release/autopublish scripts unless you intentionally want maintainer-side publishing automation and understand which credentials and repository files it may use or modify.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file presented as part of a camera snapshot/monitoring skill is actually a local release and publishing wrapper that dispatches to release automation scripts. This creates a strong mismatch between the declared purpose of the skill and the code users may invoke, increasing the chance of unintended publish-side effects and supply-chain risk if a user trusts the skill name/description and executes it in a development or CI environment.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The comments and help text frame this as a camera skill CLI, but the implemented commands perform versioning, publishing, and autopublish actions. That deceptive interface can mislead operators into running repository-modifying or release-affecting commands under false assumptions, which is especially risky in CI or privileged developer environments.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: This script introduces auto-publish and release automation that is outside the stated camera snapshot and monitoring purpose of the skill. Because it can be triggered from git hooks, CI/CD, or cron and directly execs a release script when file changes are detected, it expands the skill's operational scope into software supply-chain actions that may surprise users and create unintended publication or pipeline execution risks.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The script adds CI/CD and release-pipeline execution capability unrelated to camera monitoring, creating a supply-chain sensitive execution path. In environments where the skill is installed with hooks or integrated into automation, any content change can trigger the release workflow, potentially causing unauthorized publishing, credential use in CI, or propagation of modified artifacts.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This hook causes a normal `git push` to invoke skill publication logic, which is outside the stated camera snapshot/monitoring purpose and introduces a covert supply-chain action into developer workflow. Even though it is local and skippable, it can publish code unexpectedly, run release-side effects, and normalize hidden automation that users may not notice before pushing.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The included pre-push hook performs auto-publish behavior unrelated to the manifest's camera-monitoring functionality, creating hidden operational behavior not implied by the skill description. This mismatch increases supply-chain risk because users reviewing the skill for camera features may not expect release or distribution actions to occur during source control operations.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill enables continuous camera monitoring and stores snapshots, but the documentation lacks an explicit privacy and retention warning. In practice, users may deploy persistent surveillance or retain sensitive images without understanding the privacy implications, increasing the risk of unintended collection of occupants, visitors, screens, or other sensitive scenes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Advertising `--on-change` automation without warning about external commands or webhooks can lead users to transmit monitoring-derived data or trigger privileged actions unexpectedly. In a camera-monitoring context, this is more dangerous because change events may correlate with human presence and can be forwarded off-device or chained into shell commands with real-world consequences.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script updates SKILL.md and _meta.json before checking the --dry-run flag, so a user expecting a non-mutating preview will still have local files modified. This can cause unintended version changes, dirty git state, and accidental follow-on publishes or commits, though it does not directly create code execution or privilege-escalation risk.

Static analysis

No suspicious patterns detected.