Veo

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.3.0
• Hash: 58c594550b03edf1f89ea90f77c62f8c7ec818a8323327dcc6030c43d3f9d61b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's primary purpose is legitimate video generation using Google's Veo API. However, the `scripts/generate_video.py` script is suspicious due to a local file disclosure vulnerability. It accepts `--input-image` arguments, reads the content of the specified files, and sends these raw bytes to the Google Veo API as `imageBytes`. While intended for image files, there is no content validation, meaning an attacker could potentially use prompt injection against the OpenClaw agent to provide paths to sensitive local files (e.g., `~/.ssh/id_rsa`, `/etc/passwd`), leading to their content being read and exfiltrated to Google's API.