VN Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 0.1.0

Overview

The skill is for local media editing, but it silently installs and runs a downloaded Mac executable and may send media previews through remote chat channels, so users should review it before installing.

Install only if you are comfortable with OpenClaw downloading and running this third-party macOS bridge from GitHub, writing it persistently under ~/.openclaw/tools, removing quarantine, and sending previews through remote chat platforms when used there. Prefer a version that asks before installing/updating executables, preserves Gatekeeper checks, documents model downloads clearly, and requires confirmation before transmitting media previews.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:771

Finding

Silent Download, Quarantine Bypass, and Execution of an Unauditable Third-Party Binary

Content

View full analysis

⚠️ SHA-256 checksum mismatch — the downloaded file may be corrupted or tampered with. Installation aborted. Please try again or contact support. ```bash rm /tmp/vnapp-cli.zip ``` **Step 3 — Extract and install:** ```bash unzip -o /tmp/vnapp-cli.zip -d ~/.openclaw/tools/vnapp-cli/ chmod +x ~/.openclaw/ ...[truncated 4183 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (12)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

- The user requests `add-caption` but no SRT file path was given
- The user requests `concat-video` with fewer than 2 files
- The user requests `denoise --level custom` but no `--custom-value` was provided
- The user requests `cutout-image` but the quality intent is ambiguous (e.g. just "fast cutout" without clear context — ask: "Should I use `accurate` (best quality), `balanced`, or `fast` quality for the cutout?")
- The requested operation is outside the scope of this skill (e.g. timeline editing, adding effects)

Do not guess or assume missing required inputs — always ask first.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 789)May include surrounding context.

• If checksum does not match → stop immediately, delete the file, and tell the user:

  ⚠️ SHA-256 checksum mismatch — the downloaded file may be corrupted or tampered with. Installation aborted. Please try again or contact support.

  bash

  rm /tmp/vnapp-cli.zip
  

Step 3 — Extract and install:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill markets processing as entirely local with 'no cloud upload,' but its documented behavior still performs network activity to download the CLI and Whisper models. While this is not the same as uploading user media, it is still security-relevant external communication and can mislead users about offline behavior and trust boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The startup flow authorizes silent installation or update of an executable tool if it is missing or mismatched, without prior user approval. Downloading and installing software automatically increases supply-chain risk and removes an important consent checkpoint for executing new code on the user's machine.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The preview-delivery logic instructs the agent to send processed images/videos over remote chat platforms, which expands the skill from local processing into external distribution of user content. This can unintentionally exfiltrate sensitive media to third-party services, especially if users expect strictly local handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section explicitly instructs the agent to auto-install software silently and not ask the user, which bypasses informed consent for code download and execution. Even with checksum verification, silent installation materially increases the blast radius of a compromised release channel or mistaken tool invocation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The instruction 'do not ask the user' enables autonomous security-relevant decisions about software installation. Autonomous installation of tooling reduces user oversight and can cause the agent to change the local environment in ways the user did not authorize.

Content

Scanner excerpt · SKILL.md (reported line 771)May include surrounding context.

2C. CLI missing or outdated

Auto-install silently — do not ask the user:

Step 1 — Download:

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

Persistently installing vnapp-cli under ~/.openclaw/tools creates lasting state on disk beyond the immediate task. Persistence is not inherently malicious, but in combination with silent auto-install/update it becomes more dangerous because it leaves an executable in place for future use without explicit user consent each time.

Content

Scanner excerpt · SKILL.md (reported line 775)May include surrounding context.

Step 1 — Download:

bash

mkdir -p ~/.openclaw/tools/vnapp-cli
curl -L "https://github.com/cawcut/skill-vn/releases/download/0.1.0/vnapp-cli-darwin-universal-v0.1.0.5.zip" -o /tmp/vnapp-cli.zip

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The curl command causes outbound network access to GitHub to fetch an executable archive. External transmission is expected for installation, but in this skill it is security-sensitive because it retrieves code that will later be executed locally, making the integrity of the remote source critical.

Content

Scanner excerpt · SKILL.md (reported line 776)May include surrounding context.

Step 1 — Download:

bash

mkdir -p ~/.openclaw/tools/vnapp-cli
curl -L "https://github.com/cawcut/skill-vn/releases/download/0.1.0/vnapp-cli-darwin-universal-v0.1.0.5.zip" -o /tmp/vnapp-cli.zip

Step 2 — Verify SHA-256 before extracting:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation broadly claims processing is local/on-device with no cloud upload, yet the auto-captions feature may download speech models on first use. Even if user media is not uploaded, this contradicts the privacy/networking assurances and can mislead users operating in restricted, air-gapped, or privacy-sensitive environments into invoking a feature that performs unexpected network activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

In the VN-not-installed flow, the skill tells the user it has opened the App Store and then runs open on the App Store URL. Launching an app on the user's machine is a system-affecting action, and the instructions do not ask permission before doing so.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file documents multiple commands that write derived media or drafts to disk via output paths, but it does not include any user-facing warning about filesystem effects or potential overwriting/export behavior. Under the markdown-specific warning rule, descriptions of actions affecting user data or system state should disclose those effects.

Content

No source excerpt is available for this finding.