Ring Doorbell & Camera

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:30 AM UTC
• Version: 1.0.1

Overview

This Ring camera skill appears purpose-aligned, but it handles sensitive home-surveillance credentials and media with weak local protections.

Install only if you are comfortable giving this skill access to your Ring account and storing reusable Ring tokens plus camera snapshots under ~/.openclaw. Use it from a trusted local terminal, protect or delete the token and media files when no longer needed, and prefer a hardened version that hides password/2FA entry, pins dependencies, and sets restrictive permissions on saved credentials and images.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: ring_tool.py:15

Finding

Reusable Ring authentication token stored without restrictive file permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: ring_tool.py:25

Finding

Ring password and two-factor authentication code are visibly echoed during entry

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Security-sensitive Ring dependency is installed without version or integrity pinning

Content

View full analysis

Remediation

View remediation

] ``` Example installation workflow: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` The placeholder must be replaced with a reviewed release and its verified dependency hashes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs use of python3 commands, writes auth tokens and media files to disk, and depends on external binaries, but it does not declare any explicit tool scope such as shell, file read, or file write permissions. That mismatch can cause the agent platform to grant broader capabilities implicitly or leave users unaware that the skill will execute commands and persist sensitive data locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The setup instructions state that an authentication token will be saved to ~/.openclaw/ring_token.json, but the skill does not present this as a user-facing security warning. Ring tokens are sensitive credentials; local storage without prominent warning increases the risk of credential theft from other local users, backups, logs, or misconfigured file permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill saves captured images to ~/.openclaw/media/ring/ but does not prominently warn users that potentially sensitive home surveillance images will persist on local storage. Because these images may contain people, interiors, and activity history, silent retention creates privacy and data exposure risk if the host is shared, compromised, or routinely backed up.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Ring authentication token is written to a predictable file in the user's home directory without any apparent permission hardening, encryption, or informed consent. If another local user or process can read that file, they may gain persistent access to the user's Ring account and associated camera data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description emphasizes device control and monitoring, but the implementation also performs first-time authentication and stores persistent Ring auth tokens locally. That hidden expansion of scope increases privacy and credential-handling risk because users may not expect the skill to collect credentials and create durable access artifacts on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The tool collects the Ring password interactively in plaintext input, which can expose the credential through terminal echo, logging, shoulder surfing, or shell/session capture. In a security-sensitive context involving home surveillance accounts, insecure password entry materially raises account-compromise risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes interacting with Ring devices to list devices, capture snapshots, and view events; it does not indicate spawning local executables. While fetching Ring data is expected, launching ffmpeg introduces host-level process execution unrelated to the declared scope and increases capability beyond ordinary API interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Snapshot images from security cameras are saved to local disk without explicit notice, creating a local archive of sensitive home-surveillance media. If the host is shared, backed up broadly, or later compromised, those images can be exposed beyond the user's expectations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ring_tool.py (reported line 110)May include surrounding context.

python

if not url:
        print("ERROR: Could not get recording URL")
        sys.exit(1)
    result = subprocess.run(
        ['ffmpeg', '-y', '-i', url, '-frames:v', '1', '-q:v', '2', str(out_path)],
        capture_output=True, text=True
    )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The fallback path both executes an external media-processing binary and writes output files to disk without explicit user awareness. In this surveillance context, silent subprocess execution and local artifact creation increase privacy risk and make the behavior less transparent than users would reasonably expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.