T08 · Insecure Dependencies
Error
- Location
SKILL.md:35- Finding
Mutable External Repository Is Retrieved and Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Pro by cza999
Security checks for vulnerabilities and agentic risk
Overview
This video-generation skill is not clearly malicious, but it should be reviewed because it installs mutable external code and handles scripts and license keys without adequate safeguards.
Install only if you trust the publisher and the external openclaw-video repository at install time. Avoid using sensitive, confidential, or regulated scripts because content may be sent to OpenAI or the vendor API and is also written to local logs. Treat license keys as exposed to local files, and run installation/generation in a sandbox or separate account until the repository is pinned and logging/privacy behavior is fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/activate-premium.sh:120- Finding
Video Scripts and License Credentials Are Stored in Plaintext
- Content
View full analysis
> "$LOG_DIR/generation.log" ``` `scripts/activate-premium.sh:120-129`: ```bash cat > "$LICENSE_FILE" << EOF { "license_type": "$license_type", "license_key": "$license_key", "price": "$price", "features": "$features", "activated_at": "$(date -Iseconds)", "expires_at": "$expiry_date", "customer_id": "$USER", "machine_id": "$(hostname)" } EOF ``` `scripts/activate-premium.sh:158-160`: ```bash # 记录激活日志 echo "$(date '+%Y-%m-%d %H:%M:%S') | $license_type | $license_key | $USER@$(hostname)" >> "$CONFIG_DIR/activation.log" ``` ### Technical Analysis The generation log retains the complete user-supplied video script. The license file and activation log retain the license key together with the username and hostname. These files are created without setting a restrictive `umask` or explicitly enforcing permissions such as `0600`. Their actual accessibility therefore depends on the user's environment and default permissions. The activation log also duplicates the license key, increasing the number of locations from which it can be disclosed. The implementation does not provide the encrypted storage or automatic seven-day script deletion claimed in the project documentation. ### Attack Path 1. A user activates a license or generates a video containing confidential text. 2. The scripts write the complete license key, identity metadata, or submitted content into plaintext files. 3. The files remain on disk without implemented retention deletion or explicit restrictive permissions. 4. Another local account, a compromised process, an overly broad backup job, or a co ...[truncated 570 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.sh:42- Finding
User-Controlled Output Filename Allows Path Traversal and File Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs users to submit video scripts to a locally cloned project and separately documents remote API usage, but it does not clearly and prominently disclose that user-provided script content may be transmitted to external services such as OpenAI or the vendor API. This can lead users to unknowingly send sensitive business, personal, or proprietary content off-device, creating privacy and compliance risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The presence of a vendor-controlled external API endpoint indicates network transmission to a third party, which is a real security concern in agent skills when user data may be uploaded. The surrounding context makes this more significant because the skill markets commercial batch processing, increasing the likelihood of bulk transmission of potentially sensitive scripts.
- Content
REST API
bash # 生成视频 curl -X POST https://api.video-pro.cza999.com/generate \ -H "Authorization: Bearer $LICENSE_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The presence of a vendor-controlled external API endpoint indicates network transmission to a third party, which is a real security concern in agent skills when user data may be uploaded. The surrounding context makes this more significant because the skill markets commercial batch processing, increasing the likelihood of bulk transmission of potentially sensitive scripts.
- Content
REST API
bash # 生成视频 curl -X POST https://api.video-pro.cza999.com/generate \ -H "Authorization: Bearer $LICENSE_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The batch endpoint explicitly uploads a file of scripts to an external service, which increases exposure compared with a single request because multiple user inputs may be transferred in one operation. In a commercial video-generation context, those files may contain marketing plans, internal training material, or other sensitive content, so the lack of strong disclosure and safeguards is risky.
- Content
md }' # 批量生成 curl -X POST https://api.video-pro.cza999.com/batch \ -H "Authorization: Bearer $LICENSE_KEY" \ -F "scripts=@scripts.txt" \ -F "template=education"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
All prompts, status messages, and instructions are presented in Chinese, which imposes a specific language on users without opt-in. The file contains no indication that this skill is region-specific or that alternate locales are supported.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script claims license validation could be added later, but in practice it activates any paid license whose input merely starts with "VIDEOPRO-". This means an attacker or ordinary user can self-generate arbitrary keys and unlock premium functionality without any real authorization, undermining licensing controls and any business or access restrictions tied to paid tiers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script stores the full license key, user name, host name, and activation log in plaintext under the user's home directory without setting restrictive permissions or warning the user. On multi-user systems, backups, logs, or malware collecting dotfiles could expose the license token and system-identifying information, enabling credential reuse or privacy leakage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
All user-facing messages, usage text, and errors in the script are written in Chinese, and there is no indication that the skill supports other languages or that Chinese is a required locale. Under the policy for natural-language constraints, forcing a specific language without user opt-in is a violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's comments, usage text, errors, and status messages are presented in Chinese throughout, which imposes a specific language on users. There is no opt-in, alternate locale support, or documentation that this skill is intentionally region-specific.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The header comment states the free version is limited to videos of at most 30 seconds. However, the implementation only performs a word-count warning at L109-L116 and still proceeds with generation, so the documented restriction is not actually enforced in code.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation says the free version is restricted to 720p resolution, but no code sets, validates, or constrains output resolution. The script delegates generation to external scripts and only inspects the resulting video with ffprobe after creation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script appends the full user-provided SCRIPT content to a persistent log file without notice, minimization, or sanitization. This can expose sensitive prompts, proprietary text, personal data, or secrets entered by users, especially on shared systems or where logs are collected, backed up, or read by other tools.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language content prominently forces a specific language presentation for the skill. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This manifest contains user-facing natural language in Chinese only, but does not indicate that the skill is region-specific or that users can choose another language. That can violate language/locale policy guidance when a skill implicitly forces a specific language without user opt-in.
- Content