Security audit

Byt Workflow

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a plausible YouTube translation workflow, but its plugin manifest runs a Python file from an absolute path outside the package, so the actual code users would execute is not included for review.

Review this before installing. The main risk is not the translation workflow itself, but that the plugin points to a Python script outside the package, so installing this package does not prove what code will run. Only use it if the publisher bundles the implementation inside the package or you personally control and trust the external path. Expect it to download YouTube audio, launch and automate Doubao on a visible Windows desktop, play audio, and save output files under a Windows works directory.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

Location: openclaw.plugin.json:9
Finding: Plugin Executes an Unbundled External Entry Script<![CDATA[ ## Vulnerability Details **File Location**: `openclaw.plugin.json`, lines 1–10 **Vulnerability Type**: External tool implementation substitution **Risk Level**: High ### Vulnerable Code ```json { "id": "byt-workflow", "name": "Byt Workflow", "version": "1.0.0", "description": "YouTube video translation workflow, download audio, launch Doubao, play audio, capture translation", "tools": [ "youtube_translate" ], "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py" } ``` The security-relevant declaration is: ```json "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py" ``` ### Technical Analysis The plugin entry points to an absolute filesystem location outside the audited package. The referenced `workflow.py` file is not included in the project, whose reviewed contents consist only of `SKILL.md`, `openclaw.plugin.json`, and `package.json`. Consequently, the executable implementation cannot be reviewed alongside the manifest or bound to the integrity of the distributed package. The trusted `youtube_translate` tool name may invoke whatever file currently occupies the external path. A process or user capable of modifying that path could replace the expected workflow with attacker-controlled Python code without changing the reviewed plugin package. This is classified as tool hijacking because a legitimate-looking tool declaration delegates execution to a replaceable, unaudited implementation outside the package boundary. No evidence establishes that the missing script is currently malicious; the vulnerability is the unsafe trust boundary and substitution opportunity. ### Attack Path 1. The plugin is installed or loaded with the supplied manifest. 2. An attacker gains write access to `/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py` or creates the file if it does not exist. 3. The attacker places arbitrary Python logic at that location. 4. A user or Agent invokes the decla ...[truncated 1169 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Include `workflow.py` and all required implementation files inside the distributed skill package. 2. Replace the absolute entry with a package-relative path, for example: ```json "entry": "./scripts/workflow.py" ``` 3. Ensure package creation fails if the declared entry file is missing. 4. Apply package integrity verification, such as signed releases and cryptographic hashes, before installation or execution. 5. Restrict write permissions on installed plugin files so that untrusted users and processes cannot replace executable entries. 6. Validate at load time that the resolved entry remains within the plugin root; reject absolute paths, traversal sequences, and symbolic links that escape that root. 7. Run the skill with least privilege and limit filesystem and network access to resources required by the translation workflow. 8. Review the bundled implementation before release to confirm that its behavior matches the documented download, playback, GUI automation, and translation-capture operations. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documentation describes a workflow that downloads external content from YouTube and writes resulting audio and translation files to disk, but it does not clearly warn users about those side effects before execution. This can lead to unexpected network access, local storage of potentially copyrighted or sensitive material, and surprise persistence of outputs on the host system.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow relies on Windows GUI automation to launch Doubao, play audio, and capture translations, but the primary description does not prominently warn that it will interact with another application and requires a visible desktop session. GUI automation can cause unintended actions, interfere with user activity, and behave unpredictably if focus changes or the wrong window is targeted.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The plugin description states broad workflow capabilities for downloading audio, launching another application, playing audio, and capturing translation, but it does not define when the skill should be invoked or what user intent must be present. In an agent environment, vague trigger scope increases the chance of overbroad activation and unintended execution of potentially sensitive actions across unrelated prompts.

Natural-Language Policy Violations

Low

Confidence: 62% confidence
Finding: The documented mode options include a specific `chinese` locale-style setting, but the skill description does not explain language choice, offer user-facing opt-in guidance, or justify any locale constraints. This creates a potential natural-language policy concern if the workflow defaults or steers users toward a specific language without clear choice framing.

Static analysis

No suspicious patterns detected.