lintai docs

Appearance

Rule Reference

SEC721lintai-ai-securitythreat-reviewsecuritystableclaude_settingswarn

Claude settings: camera capture exfiltration hook

Claude settings command hook captures and exfiltrates webcam or camera data

Public lane
threat-review
Category
security
Provider
lintai-ai-security
Scope
per-file
Surface
claude_settings
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Explicit malicious, secret-bearing, or spyware-like review.

How to read this category

Strong exploit, secret, or unsafe-execution signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

threat-reviewsidecar lane
claudesurface preset

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Checks committed Claude settings command hooks for explicit webcam or camera capture utilities combined with remote transfer behavior.

Deterministic signal basis

ClaudeSettingsSignals command-hook string analysis over committed hook entries with type == command for explicit camera capture utilities such as `imagesnap`, `fswebcam`, or `ffmpeg` with camera-oriented selectors like `video=`, `/dev/video`, `-f v4l2`, `-f video4linux2`, `webcam`, or `camera`, combined with remote sinks such as `curl`, `wget`, `scp`, `rsync`, `nc`, or HTTP(S) endpoints.

Malicious corpus
claude-settings-hook-device-capture-exfil
Benign corpus
claude-settings-network-command-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule positioned as an explicit threat-review control: high-signal malicious, credential-bearing, or spyware-like behavior that stays opt-in rather than shaping the quiet default.

Nearby Signals

Related Rules

SEC641Claude settings: command hook root deletionClaude settings command hook attempts destructive root deletionthreat-reviewsecurityclaude_settings
SEC642Claude settings: command hook password file accessClaude settings command hook accesses a sensitive system password filethreat-reviewsecurityclaude_settings
SEC643Claude settings: command hook shell profile writeClaude settings command hook writes to a shell profile startup filethreat-reviewsecurityclaude_settings
SEC644Claude settings: command hook authorized_keys writeClaude settings command hook writes to SSH authorized_keysthreat-reviewsecurityclaude_settings
SEC655Claude settings: command hook cron persistenceClaude settings command hook manipulates cron persistencethreat-reviewsecurityclaude_settings
SEC656Claude settings: command hook systemd persistenceClaude settings command hook registers a systemd service or unit for persistencethreat-reviewsecurityclaude_settings

Why It Matters ​

Capturing camera data and sending it to a remote destination is high-confidence surveillance and data theft behavior.

What Triggers ​

SEC721 matches Claude settings command hooks that invoke explicit camera capture utilities such as imagesnap, fswebcam, or ffmpeg with camera-oriented selectors like video=, /dev/video, -f v4l2, -f video4linux2, webcam, or camera, and also transmit data to remote sinks such as curl, wget, scp, rsync, nc, or HTTP(S) endpoints.

False Positives ​

Shared committed Claude hooks should not capture and transmit camera data. Legitimate sharing should be deliberate user action, not hidden repo automation.

Remediation ​

Remove camera capture and remote transfer behavior from the committed Claude hook and keep captured data local unless the user explicitly chooses to share it.