Doubao Capture

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:44 AM UTC
• Version: 1.0.6

Overview

The skill describes a normal Doubao subtitle-capture workflow, but its plugin entrypoint points to an external Python file that is not included in the reviewed package.

Review before installing. The skill may be legitimate, but the package should include the Python implementation and use a package-relative entrypoint so users can verify what will run. Avoid installing this version unless you control and have audited the referenced /mnt/h/... script path.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: openclaw.plugin.json:9

Finding

Plugin Entrypoint References an External Unaudited Script

Content

View full analysis

Vulnerability Details

File Location: openclaw.plugin.json, line 9
Vulnerability Type: External tool entrypoint replacement
Risk Level: High

Vulnerable Code

json

"entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/capture_doubao_scroll_v2.py"

Technical Analysis

The plugin delegates execution to an absolute filesystem path outside the audited package. The referenced Python implementation is not included among the project files, so its behavior and integrity cannot be verified as part of this package.

This configuration also conflicts with the package-relative command documented in SKILL.md:

bash

python scripts/capture_doubao_scroll_v2.py --hwnd <window_handle> --output-dir <dir> --stop-auto --json-output

Because the external target can be modified independently of the reviewed package, control over that path permits replacement of the implementation while retaining the trusted capture_translation tool identity. The effective code executed by the plugin can therefore differ from the code—or behavior—reviewed at installation time.

Attack Path

1. The package is installed or loaded with openclaw.plugin.json as its plugin descriptor.
2. An attacker who can write to /mnt/h/AI/openclaw_workspace/video_translate/skills/ creates or replaces capture_doubao_scroll_v2.py.
3. The agent or user invokes the legitimate-looking capture_translation tool.
4. The plugin resolves its entrypoint to the attacker-controlled external file.
5. The substituted Python code executes with the privileges and environmental access of the plugin host.

Exploitation requires write access to the referenced external path or another means of controlling its resolution.

Impact Assessment

Successful exploitation permits arbitrary Python execution in the plugin host's security context. The resulting scope may include access to files, environment variables, GUI resource ...[truncated 303 chars]

Remediation

View remediation

Remediation Suggestions

1. Include capture_doubao_scroll_v2.py within the distributed package and configure a package-relative entrypoint.
2. Canonicalize the resolved entrypoint and reject startup if it escapes the package root.
3. Ensure the packaged implementation and its parent directories are not writable by untrusted users.
4. Record and verify a cryptographic hash or signed manifest for executable plugin files before invocation.
5. Fail closed when the bundled entrypoint is missing rather than falling back to an external path.
6. Align openclaw.plugin.json with the package-relative location documented in SKILL.md.
7. Audit the referenced Python implementation before deployment, because it was not included in the supplied project.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep