T07 · Tool Hijacking and Spoofing
Error
- Location
openclaw.plugin.json:9- Finding
Plugin Executes an Unbundled External Entry Script
- Content
View full analysis
- Remediation
View remediation
Security audit
Byt Workflow
Security checks for vulnerabilities and agentic risk
Overview
The skill describes a plausible YouTube translation workflow, but its plugin manifest runs a Python file from an absolute path outside the package, so the actual code users would execute is not included for review.
Review this before installing. The main risk is not the translation workflow itself, but that the plugin points to a Python script outside the package, so installing this package does not prove what code will run. Only use it if the publisher bundles the implementation inside the package or you personally control and trust the external path. Expect it to download YouTube audio, launch and automate Doubao on a visible Windows desktop, play audio, and save output files under a Windows works directory.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documentation describes a workflow that downloads external content from YouTube and writes resulting audio and translation files to disk, but it does not clearly warn users about those side effects before execution. This can lead to unexpected network access, local storage of potentially copyrighted or sensitive material, and surprise persistence of outputs on the host system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow relies on Windows GUI automation to launch Doubao, play audio, and capture translations, but the primary description does not prominently warn that it will interact with another application and requires a visible desktop session. GUI automation can cause unintended actions, interfere with user activity, and behave unpredictably if focus changes or the wrong window is targeted.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The plugin description states broad workflow capabilities for downloading audio, launching another application, playing audio, and capturing translation, but it does not define when the skill should be invoked or what user intent must be present. In an agent environment, vague trigger scope increases the chance of overbroad activation and unintended execution of potentially sensitive actions across unrelated prompts.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 62% confidence
- Finding
The documented mode options include a specific
chineselocale-style setting, but the skill description does not explain language choice, offer user-facing opt-in guidance, or justify any locale constraints. This creates a potential natural-language policy concern if the workflow defaults or steers users toward a specific language without clear choice framing.- Content