by 安全扫描
OpenClaw
可疑
medium confidence该技能从RTSP/ONVIF摄像头捕获视频帧或片段，支持本地保存和预览，适用于监控分析和AI训练素材采集。
评估建议
该技能涉及摄像头访问，安全风险较高。
1. **摄像头访问**：需要连接RTSP/ONVIF摄像头，可能涉及监控设备凭证
2. **视频数据处理**：捕获的画面可能包含敏感监控内容，需妥善保管
3. **网络连接**：需要网络访问摄像头设备，确保网络安全
4. **本地存储**：视频帧和片段保存在本地，注意存储安全
**使用注意**：
- 仅访问您有权限的摄像头设备
- 妥善保管摄像头访问凭证，不要硬编码在脚本中
- 捕获的视频内容可能涉及隐私，注意合规使用
- 建议在受控环境中使用，避免泄露监控画面
- 定期清理不需要的视频文件，释放存储空间...详细分析 ▾
ℹ 用途与能力
The skill's stated purpose (capture frames/clips from RTSP/ONVIF) aligns with the commands shown (snap, clip, watch) and the need for ffmpeg and a camsnap binary. However the registry metadata reported no install spec or config paths, while the SKILL.md explicitly refers to ~/.config/camsnap/config.yaml and a Homebrew formula—an inconsistency in declared requirements.
ℹ 指令范围
SKILL.md only instructs use of the camsnap CLI and mentions creating a local config file with camera credentials. It does not ask the agent to read unrelated system files. One area to note: the 'watch --action' usage implies arbitrary actions/commands can be run on motion events — that capability is normal for a camera tool but increases attack surface and should be reviewed.
⚠ 安装机制
The SKILL.md includes a Homebrew install entry (steipete/tap/camsnap). That is a third-party tap, not a core Homebrew formula, which is moderate risk because taps are less vetted than official releases. Also the registry metadata earlier said 'No install spec', so there's an incoherence between registry and SKILL.md about installation.
⚠ 凭证需求
The skill declares no required environment variables, which is reasonable, but instructs users to create a config file (~/.config/camsnap/config.yaml) containing camera usernames/passwords. The registry did not declare this required config path. Storing camera credentials locally (likely plaintext) is expected for the function but should be explicit and verified before use.
ℹ 持久化与权限
The skill does not request always:true or broad system privileges and appears to only create/use its own config file in the user's home directory. This is typical and not excessive, though the 'watch' action that can run arbitrary commands increases the practical privilege of whatever binary is installed.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/1/5
● 可疑
安装命令
点击复制官方npx clawhub@latest install camsnap
镜像加速npx clawhub@latest install camsnap --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Camsnap — 摄像头抓帧 安装说明： 安装命令：npx clawhub@latest install camsnap 支持国内镜像加速，使用 --registry https://cn.longxiaskill.com 参数可加速下载