by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly matches its camera-capture purpose, but there are inconsistencies (missing declared config/install requirements) and a few moderate risks you should check before installing.
评估建议
This skill appears to do what it says (capture from RTSP/ONVIF), but there are a few things to check before installing: 1) Verify the source of the camsnap binary — SKILL.md references a third-party Homebrew tap (steipete/tap); inspect that tap and the formula to confirm it points to a trustworthy upstream release. 2) Be aware camsnap will store camera credentials at ~/.config/camsnap/config.yaml — ensure you’re comfortable with how it stores secrets (plaintext vs encrypted) and limit access to ...详细分析 ▾
ℹ 用途与能力
The skill's stated purpose (capture frames/clips from RTSP/ONVIF) aligns with the commands shown (snap, clip, watch) and the need for ffmpeg and a camsnap binary. However the registry metadata reported no install spec or config paths, while the SKILL.md explicitly refers to ~/.config/camsnap/config.yaml and a Homebrew formula—an inconsistency in declared requirements.
ℹ 指令范围
SKILL.md only instructs use of the camsnap CLI and mentions creating a local config file with camera credentials. It does not ask the agent to read unrelated system files. One area to note: the 'watch --action' usage implies arbitrary actions/commands can be run on motion events — that capability is normal for a camera tool but increases attack surface and should be reviewed.
⚠ 安装机制
The SKILL.md includes a Homebrew install entry (steipete/tap/camsnap). That is a third-party tap, not a core Homebrew formula, which is moderate risk because taps are less vetted than official releases. Also the registry metadata earlier said 'No install spec', so there's an incoherence between registry and SKILL.md about installation.
⚠ 凭证需求
The skill declares no required environment variables, which is reasonable, but instructs users to create a config file (~/.config/camsnap/config.yaml) containing camera usernames/passwords. The registry did not declare this required config path. Storing camera credentials locally (likely plaintext) is expected for the function but should be explicit and verified before use.
ℹ 持久化与权限
The skill does not request always:true or broad system privileges and appears to only create/use its own config file in the user's home directory. This is typical and not excessive, though the 'watch' action that can run arbitrary commands increases the practical privilege of whatever binary is installed.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/1/4
● 可疑
安装命令
点击复制官方npx clawhub@latest install camsnap
镜像加速npx clawhub@latest install camsnap --registry https://cn.longxiaskill.com