Back to skill

Security audit

短视频黄金 3 秒钩子生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill mainly generates Chinese short-video hook text, but it also documents local analytics and daily background monitoring without enough user control or disclosure.

Review before installing. The core generator appears local and does not show credential access, dependency installation, remote code loading, or data exfiltration, but you should avoid enabling the scheduled monitoring task unless you explicitly want recurring analytics, understand what local files it creates, and have a way to remove the task. Treat generated analytics topics and optional user identifiers as potentially sensitive behavioral data.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Error
Location
DEPLOY.md:87
Finding

Optional Deployment Instructions Establish Persistent Daily Execution

Content
View full analysis
> /var/log/shortvideo-hook.log 2>&1 ``` From `PUBLISH.md:157-159`: ```powershell $action = New-ScheduledTaskAction -Execute "python" -Argument "monitor.py report" -WorkingDirectory "C:\Users\11644\.openclaw\workspace\skills\shortvideo-hook" $trigger = New-ScheduledTaskTrigger -Daily -At 7pm Register-ScheduledTask -TaskName "ShortVideoHook_Monitor" -Action $action -Trigger $trigger -Description "Short-video hook generator - daily data monitoring" ``` ### Technical Analysis The deployment documentation directs the operator to create an operating-system scheduled task or cron entry that survives the current Skill invocation and executes `monitor.py report` every day. The declared core functionality—generating short-video hooks and maintaining a daily usage count—does not require background execution. Reports can be generated on demand. Consequently, persistent OS-level scheduling exceeds the minimum execution scope necessary for the Skill. The currently scheduled payload is limited to local analytics: it reads usage records, calculates statistics, prints a report, and writes a dated JSON statistics file. No network transmission or remote payload retrieval was found. Nevertheless, the persistence mechanism creates a durable execution path. If `monitor.py`, its containing directory, or the interpreter selected by the task is later replaced, the replacement code will execute automatically under the scheduled task's account. The Windows commands ...[truncated 2157 chars]
Remediation
View remediation
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (19)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The business plan explicitly describes automatic collection of usage, conversion, and revenue data, plus timed promotional pushes to free users, without any mention of user notice, consent, retention limits, or opt-out controls. This creates a privacy and profiling risk because users may be tracked and behaviorally targeted without transparency, which can violate platform expectations or privacy regulations if implemented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes instructions to configure a scheduled monitoring task, which affects user data/privacy by collecting and storing usage information. Although privacy is mentioned later in the FAQ, the operational setup section itself lacks a clear user-facing warning or disclosure about what data is collected and where it is stored.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · DEPLOY.md (reported line 94)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 添加任务(每日 19:00)
0 19 * * * /usr/bin/python3 /path/to/shortvideo-hook/monitor.py report >> /var/log/shortvideo-hook.log 2>&1

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all operational instructions, examples, and status text exclusively in Chinese, with no indication that users can choose another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document title and all publication content are written as Chinese-only instructions for the skill, and the sample metadata to be entered on the platform is also specified in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the region/language constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language instructions and examples are presented only in Chinese, which effectively forces a specific language experience. The file does not indicate that the skill is intentionally region-specific or offer users an alternative language or opt-in to this locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README states that the skill automatically collects and reports usage data daily, but this telemetry is disclosed only deep in the documentation and without a clear upfront notice, consent flow, or opt-out mechanism. In an agent skill context, silent or poorly disclosed telemetry can expose user behavior, topics of interest, and usage patterns, creating privacy and compliance risk even if the author claims no sensitive data is collected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill claims it will 'automatically record usage counts and hot templates' but provides no details about what data is collected, where it is stored, how long it is retained, or whether users can opt out. Even if the tracking is limited, undisclosed telemetry creates a privacy and transparency risk and can lead to unauthorized collection of behavioral data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file contains the skill name, description, comments, default command, and error message in Chinese only. This can violate language/locale policy when a skill forces a specific language without user opt-in and does not state that it is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The exported description says this is a 'short video first-3-seconds hook generator', which suggests content generation logic, but this JavaScript entrypoint delegates execution by spawning an external Python interpreter. Launching subprocesses is a materially stronger capability than ordinary text processing and is not justified by the available stated purpose in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The about text explicitly says the project is completely free, which contradicts the implemented behavior elsewhere. The generator enforces a 10-per-day free quota and returns upgrade messaging for paid access, so the documentation misrepresents the actual usage model.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring and all user-facing CLI output are written exclusively in Chinese, which can amount to a forced language/locale choice if the skill is intended for general use. The file does not indicate that this is a region-specific tool or provide any opt-in or alternative language support.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script records usage events, including an optional user_id, to persistent local JSON files and the module docstring explicitly states the data is used for optimization and paid-conversion analysis. There is no consent flow, notice, minimization, retention policy beyond record count, or protection for the stored identifiers, creating a real privacy and compliance risk if deployed in a user-facing skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The package description is entirely in Chinese and presents the skill as a Chinese short-video hook generator, but the manifest does not indicate that this language constraint is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This Python file contains user-facing strings such as the docstring, test labels, and command arguments entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not indicated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

A language or locale policy issue can arise when a skill effectively forces a specific language without user opt-in. This file presents the skill description and operating context solely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

A natural-language policy issue exists when a skill or its instructions effectively force a specific language without user opt-in or justification. This document is fully Chinese-language and does not indicate that the skill is region- or language-specific, nor does it offer an alternative language option.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The FAQ states that monitoring 'only collects anonymous usage data' and does not collect personal information, but elsewhere this same document operationalizes recurring monitoring and export/report generation for dated usage data. While not definitive proof of personal-data collection, the documentation presents a stronger privacy guarantee than is justified by the described monitoring capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

All user-facing instructions, examples, and command descriptions are presented only in Chinese, which may impose a language constraint without explicit user opt-in. The file does not state that the skill is region-specific or provide any alternative language option.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:16