40Medium
The skill exposes camera credentials via command-line arguments, risking sensitive information leakage in logs and process lists.
Behavior Analysis
Description verified — behavior matches claim
Claims to do
camsnap: Use `camsnap` to grab snapshots, clips, or motion events from configured cameras.
Actually does
This skill uses the `camsnap` command-line tool to interact with configured RTSP/ONVIF cameras. It can add camera configurations to `~/.config/camsnap/config.yaml`, discover cameras, capture snapshots, record video clips, and monitor for motion events. It requires `ffmpeg` to be available on the system's PATH.
Skill Info
Namesteipete/camsnap
Registryclawhub
Version1.0.0
PURLpkg:clawhub/steipete/camsnap@1.0.0
Stars12
Downloads13,864
Installs1,089
Source
SHA-2565e499af01050...
SHA-1964d85820ab2...
MD5cc44341251bb...
TLSH821152f201bb...
Size898 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
ClawHubDocs
openclaw skills install steipete/camsnapAssessments (1)
AI Agent Traps ↗Exposure of Credentials in Command Line Argumentsmediumcredential theft
The `camsnap add` command requires camera credentials (`--user`, `--pass`) to be passed directly as command-line arguments. This method can lead to the exposure of sensitive information in process lists, command history, or logs if not handled securely by the agent.
90% confidenceline 14
camsnap add --name kitchen --host 192.168.0.10 --user user --pass pass
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/clawhub/steipete/camsnap)HTML
<a href="https://mondoo.com/ai-agent-security/skills/clawhub/steipete/camsnap"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/steipete/camsnap.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/clawhub/steipete/camsnap.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow