A skill to help you plan, script, record, edit and publish social media videos

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:59 AM UTC
• Version: 1.0.1

Overview

The skill is mostly aligned with a video creation and reminder workflow, but it asks users to paste an account token into chat and creates persistent background jobs that keep using that token.

Review this skill carefully before installing. It should not ask you to paste long-lived access tokens into chat, and its reminder jobs should be opt-in, scoped, reviewable, and easy to remove. If you use it anyway, create a minimally scoped token if possible, monitor and revoke the token when done, and inspect/remove VideoClaw cron jobs you no longer need.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: HEARTBEAT.md:20

Finding

Persistent Autonomous Reminder Agents Retain Cross-Session Access

Content

View full analysis

" }, "sessionTarget": "isolated", "wakeMode": "now", "payload": { "kind": "agentTurn", "lightContext": true, "timeoutSeconds": 120, "message": "You are a one-shot VideoClaw reminder agent.\n1. Read ~/.videoclaw_personal_mcp_token — extract PAT (full file content, trimmed). Use baseUrl app.humeo.com.\n2. Read ~/.openclaw/workspace/USER.md — extract user name (default: 'there').\n3. Call GET /api/mcp/calendar/ on the baseUrl with Authorization: Bearer .\n4. If item is missing, not planned/scripted, or targetDate has passed beyond usefulness, stop.\n5. If handoffReady is false, call POST /api/mcp/calendar//prepare on the baseUrl with same auth.\n6. Send one warm message to BOTH channels: (a) deliver via Telegram announce (handled by cron delivery config), (b) also call sessions_send with sessionKey 'agent:main:main' to post the same message to webchat. Include topic, recordingMode (capitalised), reminderMinutes, and handoffUrl as a clickable link.\n7. Call POST /api/mcp/calendar//reminded on the baseUrl with same auth." }, "delivery": { "mode": "announce", "channel": "", "to": "last", "bestEffort": true } } ``` ``` The first-time setup in `SKILL.md` also directs the agent to create persistent daily and weekly scheduled jobs: ```markdown **Step 5 — Create the daily digest cron** Use `CronCreate` with the user's time and timezone. **Step 6 — Create the weekly summary cron* ...[truncated 2280 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:150

Finding

Bearer Credential Is Collected Through Chat and Stored as Plaintext

Content

View full analysis

` 4. Continue only when `tokenValid=true`; otherwise ask for a fresh PAT ``` The corresponding runtime policy states: ```markdown - If PAT is missing or invalid, ask the user to paste the PAT directly, then store it at `~/.videoclaw_personal_mcp_token` from the OpenClaw runtime. - Prefer persistent local PAT storage at `~/.videoclaw_personal_mcp_token` to avoid repeated token refresh prompts. ``` ### Technical Analysis The Skill instructs users to submit a long-lived bearer credential directly into the conversational channel. Chat content may be retained in session history, application telemetry, model traces, backups, notification previews, or connected integration logs. Consequently, setting mode `600` on the later file does not protect the copy already disclosed through chat. The token is then stored as raw plaintext in a predictable home-directory path. Mode `600` limits ordinary cross-user access but does not protect against processes running as the same account, malicious Skills with filesystem access, compromised scheduled agents, backups, or accidental diagnostic collection. Bearer tokens confer authority through possession. Any actor who obtains the plaintext token may reuse it without needing another secret. ### Attack Path 1. The Skill asks the user to paste the complete `humeo_pat_...` value into chat. 2. The plaintext secret becomes part of the conversation context and may ent ...[truncated 1014 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: HEARTBEAT.md:29

Finding

Token-Bearing Recording Links Are Duplicated to an Unselected Communication Channel

Content

View full analysis

/reminded on the baseUrl with same auth." ``` The recording-link policy explicitly permits token material in a returned URL: ```markdown ## Recording Link Rules - Do not manually construct recording links when `magicLink` is available. - Preserve `mcpPersonalToken` when present in a returned link. - If a returned link is missing required params for its mode, retry recording-link creation once before replying. - Send links as plain clickable URLs on their own line. ``` ### Technical Analysis Setup asks the user to select a preferred reminder channel, but the one-shot cron disregards that single-channel boundary by duplicating every reminder into the fixed `agent:main:main` webchat session. This additional disclosure is not required to deliver the requested reminder. The disclosed `handoffUrl` may include an `mcpPersonalToken` query parameter. Secrets in URLs are particularly vulnerable because complete URLs can be retained by chat history, server access logs, browser history, analytics, referrer headers, link previews, screenshots, and intermediary systems. Preserving a bearer-like token in the URL and sending it to two destinations expands both the audience and the number of systems retaining the credential. If the URL grants direct access to a recording workflow, possession may allow a recipient to access or manipulate that workflow without ...[truncated 1363 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (33)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The activation rule says to use the skill whenever a user wants to plan, record, improve, or publish any video, which is overly broad for a skill that also performs token setup, file edits, and scheduling operations. Broad triggering increases the chance that sensitive setup or privileged side effects occur in contexts where the user only wanted lightweight creative help.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

- `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- `TOOL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

- `TOOL.md`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The skill instructs the agent to take a value returned from an API response and pass it directly into openclaw cron remove {cronJobId}. If not strictly validated, this can become tool-parameter abuse, deleting arbitrary cron jobs or causing broader side effects depending on how the command interface parses identifiers.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

### When deleting a calendar item

1. Call `DELETE /api/mcp/calendar/{id}`.
2. The response includes `cronJobId` — if set, run `openclaw cron remove {cronJobId}`.

### When marking an item done or skipped

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill initiates a flow to create a personal access token and prepares the user to disclose it to the system. In the context of a user-facing creative skill, credential acquisition is unusually sensitive and can enable broad downstream access well beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

Walk through these steps in order. Do not skip or assume they are already done.

**Step 1 — Create a Personal Access Token**
Tell the user: "Open Humeo at http://localhost:3000/profile/mcp and create a new Personal Access Token. Copy the full token (it starts with `humeo_pat_`)."

**Step 2 — Save and verify the token**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The instruction to ask the user to paste the PAT in chat is direct credential collection. This is dangerous because it exposes a bearer secret in a conversational channel where it may be retained, inspected, or mishandled by components not intended to store secrets.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

Walk through these steps in order. Do not skip or assume they are already done.

**Step 1 — Create a Personal Access Token**
Tell the user: "Open Humeo at http://localhost:3000/profile/mcp and create a new Personal Access Token. Copy the full token (it starts with `humeo_pat_`)."

**Step 2 — Save and verify the token**
Ask the user to paste the PAT in chat, then:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions tell the user to paste a full personal access token into chat without a clear warning that this exposes a credential to the assistant, logs, and potentially other storage layers. This normalizes unsafe credential-sharing and materially increases the chance of account compromise.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The setup flow operationalizes credential capture by instructing the agent to receive the PAT in chat, save it locally, and verify it. This is a classic secret persistence pattern that expands the attack surface from transient disclosure to durable compromise if the file, session, or logs are accessed.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The scheduled daily digest agent is instructed to read a stored PAT from disk and use it to access calendar data for outbound messaging. Embedding credential use into autonomous scheduled tasks creates persistent privileged behavior that can continue without active user review and increases the blast radius if the cron payload or environment is altered.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The weekly summary cron similarly instructs the agent to read a stored PAT and compile account activity into an outbound message. This combines credential reuse with autonomous data aggregation and external delivery, increasing the risk of privacy leakage or unauthorized account access if misconfigured or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to ask users to paste a PAT directly into chat, which creates a high risk of credential exposure through chat logs, transcripts, analytics, screenshots, and downstream model processing. Credentials should not be collected in general conversation channels unless there is a dedicated secure secret-entry path with clear warnings and handling guarantees.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Documenting a DELETE capability for personal-token management gives the agent authority to modify authentication state, which can be abused for denial of service or destructive account-side effects if invoked incorrectly or by prompt injection. Destructive auth operations are especially sensitive because they can interrupt service and force credential re-entry.

Content

Scanner excerpt · TOOL.md (reported line 69)May include surrounding context.

md

## Core Endpoints (Internal)

- `GET|POST|DELETE /api/mcp/auth/personal-token`
- `GET|POST /api/mcp/auth/personal-token/status`
- `POST /api/mcp/hooks/create`
- `POST /api/mcp/teleprompter/scripts/create`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

A DELETE endpoint for calendar items enables destructive state changes that an agent could trigger accidentally, through misunderstanding, or via prompt manipulation. In a skill that also manages reminders and cron cleanup, deletion can remove planned tasks and associated scheduling artifacts, causing silent workflow disruption.

Content

Scanner excerpt · TOOL.md (reported line 88)May include surrounding context.

md

- `POST /api/mcp/calendar/add`
- `GET /api/mcp/calendar/list`
- `PATCH /api/mcp/calendar/{id}` — update topic, notes, targetDate, recordingMode, reminderMinutes, cronJobId
- `DELETE /api/mcp/calendar/{id}` — returns cronJobId for cleanup
- `GET /api/mcp/calendar/{id}` — fetch one calendar item by id (owner-only), used by one-shot reminder crons
- `PATCH /api/mcp/calendar/{id}/status`
- `POST /api/mcp/calendar/{id}/prepare`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The heartbeat task is designed to modify remote state by creating cron jobs and patching calendar items automatically. Background state changes without prominent disclosure or confirmation are dangerous because they create persistence and can alter user workflows or notification behavior without the user's immediate awareness.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The heartbeat instructions read a personal token from the user's home directory and use it for background calls to an external service. Even if related to calendar reminders, this grants the skill unattended access to account-scoped resources without an explicit per-action consent flow, increasing the risk of misuse or overreach if the skill is modified or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file instructs the agent to read a personal access token and transmit it in Authorization headers to a remote API without any user-facing warning in the heartbeat behavior. Handling secrets this way in an autonomous background path raises the chance of silent account access and makes abuse harder for the user to detect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The heartbeat logic uses persisted user/session context from USER.md and routes alerts into the main session, which introduces a form of cross-session persistence and coupling. In context this is less severe than credential misuse, but it still allows background logic to influence the main conversational channel and reuse stored preferences without a fresh user action.

Content

Scanner excerpt · HEARTBEAT.md (reported line 16)May include surrounding context.

md

Steps:

1. Read `~/.videoclaw_personal_mcp_token` → extract `pat` (full file content, trimmed). Use baseUrl `app.humeo.com`.
2. Read `~/.openclaw/workspace/USER.md` → find the `## Notifications` section and extract the `Preferred reminder channel` value. Store it as `notifyChannel`. If the section is missing or the value is not set, **do not create the cron** — instead alert the user in the main session and ask them which channel they want reminders on before proceeding.
3. Call `GET /api/mcp/calendar/list?status=planned&limit=100` on the baseUrl with `Authorization: Bearer <pat>`.
4. For each item in the response:
   a. Skip if `targetDate` is null.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill autonomously creates cron jobs and triggers reminder delivery to Telegram and webchat from a heartbeat loop. This is a real security concern because it enables unattended background actions and outbound messaging, which can surprise users, spam channels, or be repurposed for persistence and covert communication.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: video-claw-skills
description: End-to-end video creation copilot for OpenClaw. Helps users brainstorm ideas, research angles, generate hooks and teleprompter scripts, create recording links, process interviews, edit transcripts and video cuts, render final outputs, and publish content. Use this skill whenever a user wants to plan, record, improve, or publish any video, especially personal-branding content.
---

# Video Claw Skills

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

This setup section begins a process that results in long-lived credential storage and reuse across sessions. The persistence aspect matters because it turns a one-time auth action into ongoing model-accessible authority without clear lifecycle controls.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

Walk through these steps in order. Do not skip or assume they are already done.

**Step 1 — Create a Personal Access Token**
Tell the user: "Open Humeo at http://localhost:3000/profile/mcp and create a new Personal Access Token. Copy the full token (it starts with `humeo_pat_`)."

**Step 2 — Save and verify the token**

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly asks the user to paste a personal access token into chat and then persist it in a local file for later reuse. This creates a direct secret-handling risk because chat transcripts, agent logs, and local storage may expose the token and enable unauthorized API access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to read and modify local OpenClaw state files and to create, run, and remove cron jobs as part of normal operation. That exceeds a typical video-creation copilot scope and grants the skill broad control over host automation and user configuration, which could be abused to persist behavior, alter notification routing, or trigger unintended actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

Writing notification preferences into USER.md for heartbeat consumption creates cross-session persistent state that affects future autonomous actions. While less severe than token storage, it still allows the skill to modify durable runtime behavior outside the immediate chat context.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Notifications

• Preferred reminder channel: <the channel the user chose, e.g. telegram>

text

This is what the heartbeat reads at runtime to set the delivery channel when creating per-event crons. If this value is missing, the heartbeat will not create crons and will alert the user instead. Do not skip this write step.

**Step 4 — Ask for digest time and timezone**
Ask: *"What time would you like your daily recording digest? Default is 9:00 AM. And what's your timezone? (e.g. Asia/Colombo, Europe/London, America/New_York)"*

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · TOOL.md (reported line 12)May include surrounding context.

md

- Use this file for implementation and sequencing.
- Do not expose internal route names, token fields, headers, IDs, or command templates to users unless they explicitly ask for debugging.
- Keep user-facing responses outcome-first and creator-friendly.
- Do not create local script files (`.sh`, `.ps1`, `.bat`) as a workaround for normal flows.

## Runtime Auth

Static analysis

No suspicious patterns detected.