中文 EN
Start Review
Skill Trust Decision

smart-eye

SmartEye 是合法的摄像头 PTZ 控制技能，仅在内网环境下与摄像头通信，无恶意行为，但存在轻微权限声明宽泛的问题。

Install decision first Source: ClawHub Scanned: Apr 11, 2026
Files 16
Artifacts 12
Violations 0
Findings 4

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

权限声明宽泛 +10

SKILL.md 未声明 allowed-tools，代码涉及 filesystem:WRITE、network:WRITE、shell:WRITE

华为 SSL 禁用 +5

huawei_ptz.py 使用 ssl.CERT_NONE，已在文档中警告

示例凭证存在 +5

camera-devices.json 包含默认密码，已在文档中警告需替换

Most important evidence

Low Priv Escalation

未声明的 allowed-tools

SKILL.md 未声明 allowed-tools，代码实际使用了 filesystem:WRITE、network:WRITE、shell:WRITE 权限

SKILL.md:1
在 SKILL.md 顶部添加 allowed-tools 声明
Low Supply Chain

依赖无版本锁定

pyproject.toml 中 opencv-python>=4.8.0 使用了宽松版本约束

pyproject.toml:12
考虑固定版本以避免供应链风险
Info Sensitive Access

华为摄像头禁用 SSL 验证

华为 PTZ 代码使用 ssl.CERT_NONE 禁用证书验证，仅适合可信内网。已在 SKILL.md 安全说明中警告。

src/protocol/brands/huawei_ptz.py:19
已文档化，符合预期
Info Sensitive Access

示例凭证存在

捆绑配置文件包含示例密码 YOUR_TPLINK_PASSWORD，已在 SKILL.md 和 JSON 注释中警告需替换

devices/camera-devices.json:3
已文档化，符合预期

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred WRITE
src/protocol/base.py:188 snapshot() 保存 JPG 到本地
Network Pass
Declared NONE
→
Inferred WRITE
src/protocol/brands/onvif_ptz_control.py:54 urllib.request.urlopen() 访问摄像头
Shell Pass
Declared NONE
→
Inferred WRITE
src/protocol/brands/tplink.py:87 subprocess.Popen([vlc, rtsp])
Environment Pass
Declared NONE
→
Inferred READ
src/config.py:23 Path.home() 访问用户目录

Suspicious artifacts and egress

Medium External URL
http://www.onvif.org/2003/11/soap-envelope

src/protocol/brands/huawei_ptz.py:39

Medium External URL
http://www.onvif.org/ver20/ptz/wsdl

src/protocol/brands/huawei_ptz.py:40

Medium External URL
http://www.onvif.org/ver10/schema

src/protocol/brands/huawei_ptz.py:41

Medium External URL
http://www.w3.org/2003/05/soap-envelope

src/protocol/brands/onvif_ptz_control.py:45

Medium External URL
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd

src/protocol/brands/onvif_ptz_control.py:46

Medium External URL
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd

src/protocol/brands/onvif_ptz_control.py:47

Medium External URL
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest

src/protocol/brands/onvif_ptz_control.py:52

Medium External URL
http://www.onvif.org/ver20/ptz/wsdl/GetStatus

src/protocol/brands/onvif_ptz_control.py:81

Medium External URL
http://www.onvif.org/ver20/ptz/wsdl/AbsoluteMove

src/protocol/brands/onvif_ptz_control.py:102

Medium External URL
http://www.onvif.org/ver20/ptz/wsdl/ContinuousMove

src/protocol/brands/onvif_ptz_control.py:129

Medium External URL
http://www.onvif.org/ver20/ptz/wsdl/Stop

src/protocol/brands/onvif_ptz_control.py:137

Medium External URL
http://example/action

src/protocol/onvif.py:28

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
opencv-python >=4.8.0 pip No 宽松版本约束，建议固定版本

File composition

16 files · 1680 lines
Python 13 files · 1526 linesMarkdown 1 files · 97 linesJSON 1 files · 43 linesTOML 1 files · 14 lines
Files of concern · 5
src/protocol/onvif.py Python · 202 lines
http://example/action
src/protocol/brands/onvif_ptz_control.py Python · 142 lines
http://www.w3.org/2003/05/soap-envelope · http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd · http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd · http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest · http://www.onvif.org/ver20/ptz/wsdl/GetStatus · http://www.onvif.org/ver20/ptz/wsdl/AbsoluteMove · http://www.onvif.org/ver20/ptz/wsdl/ContinuousMove · http://www.onvif.org/ver20/ptz/wsdl/Stop
SKILL.md Markdown · 97 lines
未声明的 allowed-tools
src/protocol/brands/huawei_ptz.py Python · 112 lines
华为摄像头禁用 SSL 验证 · http://www.onvif.org/2003/11/soap-envelope · http://www.onvif.org/ver20/ptz/wsdl · http://www.onvif.org/ver10/schema
devices/camera-devices.json JSON · 43 lines
示例凭证存在
Other files · smarteye.py · base.py · huawei.py · tplink.py · config.py · base_brand.py +1

Security positives

代码结构清晰，无混淆或隐藏指令
凭证从配置文件动态读取，无硬编码
仅在内网运行，无公网通信
文档中有安全警告（华为 SSL、示例凭证）
无凭证收割、环境变量遍历等恶意行为
无数据外泄、C2 通信等可疑行为
使用标准协议（ONVIF SOAP、RTSP）
权限仅用于声明的摄像头控制功能