Security audit

Photo Webcam Tool Free

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent webcam snapshot purpose, but it gives agents broad URL-download and file-write instructions without enough safety boundaries.

Review before installing. Use this only with trusted webcam URLs and trusted favorites files, save outputs to a dedicated temporary snapshot directory, avoid running it with broad filesystem or internal-network access, and install dependencies in an isolated virtual environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:205
Finding: Unrestricted Remote Image URLs Permit SSRF-Like Network Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:99
Finding: User-Controlled Output Path Can Overwrite Agent-Accessible Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:237
Finding: Unpinned Package Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to fetch remote webcam images and write them to local paths such as /tmp, but the description does not clearly warn users that network access and local file creation will occur. This reduces informed consent and can lead users to trigger unintended downloads, storage of untrusted content, or privacy/security issues in restricted environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The display name, summary, and nearly all usage instructions are presented only in Chinese, with no note that other languages are supported or that Chinese is optional. This can be a language-policy issue when a skill implicitly forces one language without user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.