lintai docs

Appearance

Rule Reference

SEC713lintai-ai-securitythreat-reviewsecuritystablehookdeny

Hook script: camera capture exfiltration

Hook script captures and exfiltrates camera or webcam data

Public lane
threat-review
Category
security
Provider
lintai-ai-security
Scope
per-file
Surface
hook
Tier
stable
Severity
deny
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Explicit malicious, secret-bearing, or spyware-like review.

How to read this category

Strong exploit, secret, or unsafe-execution signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

threat-reviewsidecar lane

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Matches explicit camera or webcam capture utilities combined with remote transfer behavior in executable hook lines.

Deterministic signal basis

HookSignals command-line analysis over non-comment hook lines for explicit camera capture utilities such as `imagesnap`, `fswebcam`, or `ffmpeg` with camera or video device selectors, combined with remote sinks such as `curl`, `wget`, `scp`, `rsync`, `nc`, or HTTP(S) endpoints.

Malicious corpus
hook-device-capture-exfil
Benign corpus
cursor-plugin-clean-basic
structured evidence required remediation reviewed
Canonical note

Structural stable rule positioned as an explicit threat-review control: high-signal malicious, credential-bearing, or spyware-like behavior that stays opt-in rather than shaping the quiet default.

Nearby Signals

Related Rules

SEC201Hook script: remote code executionHook script downloads remote code and executes itthreat-reviewsecurityhook
SEC202Hook script: secret exfiltrationHook script appears to exfiltrate secrets through a network callthreat-reviewsecurityhook
SEC203Hook script: insecure HTTP secret sendHook script sends secret material to an insecure http:// endpointthreat-reviewsecurityhook
SEC204Hook script: TLS verification disabledHook script disables TLS or certificate verification for a network callthreat-reviewsecurityhook
SEC205Hook script: hardcoded auth in network callHook script embeds static authentication material in a network callthreat-reviewsecurityhook
SEC206Hook script: base64 payload executionHook script decodes a base64 payload and executes itthreat-reviewsecurityhook

Why It Matters ​

Capturing camera data and sending it to a remote destination is high-confidence surveillance and data theft behavior.

What Triggers ​

SEC713 matches executable hook lines that invoke explicit camera capture utilities such as imagesnap, fswebcam, or ffmpeg with camera-oriented selectors like video=, /dev/video, -f v4l2, -f video4linux2, webcam, or camera, and also transmit data to remote sinks such as curl, wget, scp, rsync, nc, or HTTP(S) endpoints.

False Positives ​

Shared committed hooks should not capture and transmit camera data. Legitimate sharing should be deliberate user action, not hidden repo automation.

Remediation ​

Remove camera capture and remote transfer behavior from the shared hook and keep captured data local unless the user explicitly chooses to share it.