Skills onvifscan

📦

onvifscan

Name: onvifscan
Author: BrownFineSecurity

Content revision r2 High Risk ⚙️ External commands🌐 Network access

Assess ONVIF Device Security

ONVIF cameras can expose services or use weak credentials. This skill guides authorized authentication checks and controlled credential tests with onvifscan.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "onvifscan" from https://skillstore.io/skills/brownfinesecurity-onvifscan.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-onvifscan/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/brownfinesecurity-onvifscan.md Signed manifest GET /api/skills/brownfinesecurity-onvifscan/manifest Signed lockfile GET /api/skills/brownfinesecurity-onvifscan/lockfile

Test it

Using "onvifscan". Check whether my lab camera requires ONVIF authentication.

Expected outcome:

The assessment starts with the standard authentication check. Report each endpoint as protected, exposed, unreachable, or inconclusive.

Using "onvifscan". Test approved credentials without risking an account lockout.

Expected outcome:

The plan confirms authorization, attempt limits, delay settings, stop conditions, and the approved wordlists before any credential test.

Using "onvifscan". Review a camera on a nonstandard port with detailed responses.

Expected outcome:

The scan uses the supplied port and verbose mode. The summary highlights authentication status and relevant ONVIF response details.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks or private-network examples. Six examples direct external scanner execution, while credential brute-forcing and potentially destructive tests lack mandatory authorization controls.

Files scanned

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:8-14 SKILL.md:46-55 SKILL.md:69-72

Credential Brute-Forcing Without Authorization Controls

The skill directs credential attacks against user-supplied ONVIF targets but never requires ownership, written authorization, scope validation, or lockout approval.

The prose explicitly describes brute-forcing credentials and supplies commands and wordlist options. No authorization gate appears anywhere in the 81-line skill.

High

SKILL.md:41-44 SKILL.md:74-79

Potentially Destructive Endpoint Testing

The skill exposes an all-endpoints option that may test destructive operations, with only a caution note and no mandatory confirmation or endpoint preview.

Lines 43 and 78 explicitly state that the all-endpoints option can test potentially destructive endpoints. The skill defines no enforced safety gate.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:31

Ruby/shell backtick execution

- Format: `onvifscan <subcommand> <url> [options]`

Line 31 provides an external onvifscan command template containing user-supplied target and option placeholders. Execution can cause network activity and unsafe interpolation could permit command injection.

Medium

SKILL.md:37-39

Ruby/shell backtick execution

```bash

Lines 37-39 explicitly present an onvifscan auth command for execution against a network target. The command invokes an external security scanner.

Medium

SKILL.md:48-50

Ruby/shell backtick execution

```bash

Lines 48-50 provide an executable onvifscan brute command against a network target. Running it initiates credential attempts through an external tool.

Medium

SKILL.md:60-62

Ruby/shell backtick execution

```bash

Lines 60-62 present a complete external auth-scan command. Execution sends ONVIF requests to the specified device.

Medium

SKILL.md:65-67

Ruby/shell backtick execution

```bash

Lines 65-67 provide a complete verbose auth-scan command invoking onvifscan against a network device. This is genuine external tool execution guidance.

Medium

SKILL.md:70-72

Ruby/shell backtick execution

```bash

Lines 70-72 provide a complete brute-force command using external wordlist files. Running it initiates credential attacks against the target device.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/brownfinesecurity-onvifscan/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/brownfinesecurity-onvifscan/security.svg)](https://skillstore.io/skills/brownfinesecurity-onvifscan?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/brownfinesecurity-onvifscan?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-onvifscan/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-onvifscan.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

BrownFineSecurity. (2026). onvifscan security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-onvifscan/audits/9

BibTeX citation

@techreport{brownfinesecurity-brownfinesecurity-onvifscan-2026,
  author = {BrownFineSecurity},
  title = {onvifscan security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/brownfinesecurity-onvifscan/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "onvifscan security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "BrownFineSecurity"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/brownfinesecurity-onvifscan/audits/9"
identifiers:
  - type: other
    value: "skillstore:brownfinesecurity-onvifscan:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Audit Camera Authentication

Check whether managed cameras expose ONVIF endpoints without required authentication.

Validate Credential Controls

Run approved, rate-limited credential tests with client-provided wordlists and scope.

Test Device Hardening

Compare authentication behavior across firmware builds in an isolated test environment.

Try These Prompts

Check Authentication

I am authorized to test [target]. Prepare a basic ONVIF authentication check and explain the expected result categories.

Inspect Detailed Responses

I am authorized to test [target:port]. Plan a verbose authentication scan and summarize which response details may indicate exposed services.

Test Approved Credentials

Plan a rate-limited credential test for [target] using [username file] and [password file]. Confirm authorization and lockout limits before execution.

Plan a Scoped Assessment

Design an ONVIF assessment for [targets]. Separate safe checks from potentially destructive tests, define stop conditions, and require confirmation before execution.

Best Practices

Obtain written authorization and define target scope before every scan.
Start with authentication checks and use credential testing only when explicitly approved.
Set attempt limits, stop conditions, and recovery plans before testing production devices.

Avoid

Do not scan internet hosts or third-party devices without explicit permission.
Do not enable all-endpoints testing on production devices without separate confirmation.
Do not use large wordlists when lockout behavior and device capacity are unknown.

Frequently Asked Questions

What devices can this skill assess?

It targets IP cameras and other devices that expose ONVIF services.

Does the skill include onvifscan?

No. The external onvifscan command must already be available from the iothackbot installation.

Is the authentication check non-destructive?

The standard check is described as non-destructive. The all-endpoints option may test destructive operations.

Can it test weak credentials?

Yes. It supports rate-limited credential testing with built-in or custom wordlists.

Does it verify authorization?

No. Users must confirm ownership, permission, target scope, and lockout limits before testing.

Which output formats are supported?

The documented formats are text, JSON, and quiet output.

Developer Details

Author

BrownFineSecurity

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/BrownFineSecurity/iothackbot/tree/master/skills/onvifscan

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

6 downloads · 228 views

File structure

📄 SKILL.md