Video Pro by cza999

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:18 AM UTC
• Version: 1.0.0

Overview

This video-generation skill is not clearly malicious, but it should be reviewed because it installs mutable external code and handles scripts and license keys without adequate safeguards.

Install only if you trust the publisher and the external openclaw-video repository at install time. Avoid using sensitive, confidential, or regulated scripts because content may be sent to OpenAI or the vendor API and is also written to local logs. Treat license keys as exposed to local files, and run installation/generation in a sandbox or separate account until the repository is pinned and logging/privacy behavior is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:35
• Finding: Mutable External Repository Is Retrieved and Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-37`; `_meta.json:18-20, 39-52` **Vulnerability Type**: Unpinned third-party dependency and unsafe external source installation **Risk Level**: High ### Vulnerable Code `SKILL.md:35-37`: ```bash git clone https://github.com/ZhenRobotics/openclaw-video.git ~/openclaw-video-pro cd ~/openclaw-video-pro npm install ``` `_meta.json:18-20`: ```json "dependencies": { "openclaw-video": "git+https://github.com/ZhenRobotics/openclaw-video.git" }, ``` `_meta.json:39-52`: ```json "install": [ { "id": "project", "kind": "git", "repo": "https://github.com/ZhenRobotics/openclaw-video.git", "target": "~/openclaw-video-pro", "label": "克隆视频生成项目" }, { "id": "deps", "kind": "npm", "package": "安装依赖", "cwd": "~/openclaw-video-pro", "label": "安装项目依赖" } ] ``` ### Technical Analysis The installation process clones the mutable default branch of an external Git repository and subsequently installs its npm dependencies. No reviewed commit SHA, immutable release artifact, checksum, signature, or dependency lockfile is specified. Consequently, the effective code executed by users can change after this Skill package has been audited. In addition, npm installation may execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. These scripts run with the privileges of the user performing the installation. The external dependency repository is also different from the repository declared as the Skill's own repository. That relationship is not protected by any technical trust or integrity mechanism. ### Attack Path 1. An attacker compromises the external Git repository, a maintainer account, or one of its transitive npm dependencies. 2. The attacker modifies the default branch or publishes a dependency version containing a malicious lifecycle script. 3. A user follows the documented installation process or the platform processes the installation ...[truncated 850 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external repository to a reviewed commit SHA rather than its default branch. 2. Prefer a signed, immutable release artifact and verify its cryptographic checksum before use. 3. Include a reviewed npm lockfile and use `npm ci` instead of `npm install`. 4. Use `npm ci --ignore-scripts` when lifecycle scripts are unnecessary. If scripts are required, audit and explicitly allow them. 5. Pin and audit all direct and transitive dependencies. 6. Run installation in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted network access. 7. Clearly document why the external repository differs from the Skill repository and define the trusted version. 8. Add automated dependency and integrity checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/activate-premium.sh:120
• Finding: Video Scripts and License Credentials Are Stored in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.sh:186-189`; `scripts/activate-premium.sh:120-129, 158-160` **Vulnerability Type**: Plaintext storage and logging of sensitive information **Risk Level**: Medium ### Vulnerable Code `scripts/generate.sh:186-189`: ```bash # 记录日志 echo "$(date '+%Y-%m-%d %H:%M:%S') | $SCRIPT | $TEMPLATE | $VOICE | $SPEED | $OUTPUT_NAME" >> "$LOG_DIR/generation.log" ``` `scripts/activate-premium.sh:120-129`: ```bash cat > "$LICENSE_FILE" << EOF { "license_type": "$license_type", "license_key": "$license_key", "price": "$price", "features": "$features", "activated_at": "$(date -Iseconds)", "expires_at": "$expiry_date", "customer_id": "$USER", "machine_id": "$(hostname)" } EOF ``` `scripts/activate-premium.sh:158-160`: ```bash # 记录激活日志 echo "$(date '+%Y-%m-%d %H:%M:%S') | $license_type | $license_key | $USER@$(hostname)" >> "$CONFIG_DIR/activation.log" ``` ### Technical Analysis The generation log retains the complete user-supplied video script. The license file and activation log retain the license key together with the username and hostname. These files are created without setting a restrictive `umask` or explicitly enforcing permissions such as `0600`. Their actual accessibility therefore depends on the user's environment and default permissions. The activation log also duplicates the license key, increasing the number of locations from which it can be disclosed. The implementation does not provide the encrypted storage or automatic seven-day script deletion claimed in the project documentation. ### Attack Path 1. A user activates a license or generates a video containing confidential text. 2. The scripts write the complete license key, identity metadata, or submitted content into plaintext files. 3. The files remain on disk without implemented retention deletion or explicit restrictive permissions. 4. Another local account, a compromised process, an overly broad backup job, or a co ...[truncated 570 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not write complete license keys to logs. Redact them, for example by retaining only a short non-secret suffix. 2. Avoid logging full user-submitted scripts. Store only non-sensitive metadata or a keyed digest when correlation is required. 3. Set `umask 077` before creating configuration, credential, and log files. 4. Create sensitive files with mode `0600` and configuration directories with mode `0700`. 5. Store reusable credentials through an operating-system credential manager or secure secret store. 6. Remove the license key from `activation.log` and migrate or securely delete existing logs. 7. Implement the documented retention period and securely remove expired script records. 8. Add log rotation, retention limits, and explicit guidance excluding sensitive logs from support bundles and broadly accessible backups. 9. Correct privacy documentation if encryption and automatic deletion are not actually implemented. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.sh:42
• Finding: User-Controlled Output Filename Allows Path Traversal and File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.sh:42-58, 155` **Vulnerability Type**: Path traversal through an unvalidated output filename **Risk Level**: Medium ### Vulnerable Code `scripts/generate.sh:42-58`: ```bash while [[ $# -gt 0 ]]; do case $1 in --template) TEMPLATE="$2" shift 2 ;; --voice) VOICE="$2" shift 2 ;; --speed) SPEED="$2" shift 2 ;; --output) OUTPUT_NAME="$2" shift 2 ;; *) SCRIPT="$1" shift ;; esac done ``` `scripts/generate.sh:155`: ```bash cp "$output_file" "$OUTPUT_DIR/$OUTPUT_NAME" ``` ### Technical Analysis The value supplied through `--output` is concatenated directly with `OUTPUT_DIR`. It is not restricted to a basename and is not checked for directory separators, `..` components, absolute paths, symbolic-link behavior, or containment within the expected output directory. Shell quoting prevents command injection but does not prevent filesystem path traversal. For example, an output value containing multiple `../` components can resolve outside `OUTPUT_DIR`. The `cp` command overwrites an existing writable destination by default. The copied data is a generated video, so the attacker cannot freely select arbitrary file contents through this flaw alone. Nevertheless, overwriting an existing user-writable file can cause data loss or disrupt applications that consume the targeted file. ### Attack Path 1. An attacker controls or influences the arguments passed to `generate.sh`. 2. The attacker supplies an output value such as `--output ../../target-file`. 3. The script accepts the value without validation. 4. After video generation, the destination is constructed as `$OUTPUT_DIR/../../target-file`. 5. Filesystem path resolution escapes the intended output directory. 6. `cp` overwrit ...[truncated 682 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict `--output` to a filename rather than an arbitrary path. 2. Reject values containing `/`, `\`, `..`, control characters, or an empty basename. 3. Apply an allowlist such as `^[A-Za-z0-9][A-Za-z0-9._-]*\.mp4$`. 4. Canonicalize the destination and verify that it remains beneath the canonical `OUTPUT_DIR`. 5. Refuse to overwrite existing files by default, for example with `cp -n`, and require an explicit safe overwrite option when needed. 6. Check for symbolic links before writing and use a safe file-creation strategy that prevents link-following races. 7. Validate that options requiring values actually have a following argument before reading `$2`. 8. Add tests covering `../`, absolute paths, nested separators, symbolic links, and pre-existing destination files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to submit video scripts to a locally cloned project and separately documents remote API usage, but it does not clearly and prominently disclose that user-provided script content may be transmitted to external services such as OpenAI or the vendor API. This can lead users to unknowingly send sensitive business, personal, or proprietary content off-device, creating privacy and compliance risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

### REST API
```bash
# 生成视频
curl -X POST https://api.video-pro.cza999.com/generate \
  -H "Authorization: Bearer $LICENSE_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 83% confidence
• Finding: The presence of a vendor-controlled external API endpoint indicates network transmission to a third party, which is a real security concern in agent skills when user data may be uploaded. The surrounding context makes this more significant because the skill markets commercial batch processing, increasing the likelihood of bulk transmission of potentially sensitive scripts.

External Transmission

Medium

• Category: Data Exfiltration

Content

### REST API
```bash
# 生成视频
curl -X POST https://api.video-pro.cza999.com/generate \
  -H "Authorization: Bearer $LICENSE_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 83% confidence
• Finding: The presence of a vendor-controlled external API endpoint indicates network transmission to a third party, which is a real security concern in agent skills when user data may be uploaded. The surrounding context makes this more significant because the skill markets commercial batch processing, increasing the likelihood of bulk transmission of potentially sensitive scripts.

External Transmission

Medium

• Category: Data Exfiltration

Content

}'

# 批量生成
curl -X POST https://api.video-pro.cza999.com/batch \
  -H "Authorization: Bearer $LICENSE_KEY" \
  -F "scripts=@scripts.txt" \
  -F "template=education"

• Confidence: 90% confidence
• Finding: The batch endpoint explicitly uploads a file of scripts to an external service, which increases exposure compared with a single request because multiple user inputs may be transferred in one operation. In a commercial video-generation context, those files may contain marketing plans, internal training material, or other sensitive content, so the lack of strong disclosure and safeguards is risky.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: All prompts, status messages, and instructions are presented in Chinese, which imposes a specific language on users without opt-in. The file contains no indication that this skill is region-specific or that alternate locales are supported.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script claims license validation could be added later, but in practice it activates any paid license whose input merely starts with "VIDEOPRO-". This means an attacker or ordinary user can self-generate arbitrary keys and unlock premium functionality without any real authorization, undermining licensing controls and any business or access restrictions tied to paid tiers.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script stores the full license key, user name, host name, and activation log in plaintext under the user's home directory without setting restrictive permissions or warning the user. On multi-user systems, backups, logs, or malware collecting dotfiles could expose the license token and system-identifying information, enabling credential reuse or privacy leakage.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: All user-facing messages, usage text, and errors in the script are written in Chinese, and there is no indication that the skill supports other languages or that Chinese is a required locale. Under the policy for natural-language constraints, forcing a specific language without user opt-in is a violation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script's comments, usage text, errors, and status messages are presented in Chinese throughout, which imposes a specific language on users. There is no opt-in, alternate locale support, or documentation that this skill is intentionally region-specific.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The header comment states the free version is limited to videos of at most 30 seconds. However, the implementation only performs a word-count warning at L109-L116 and still proceeds with generation, so the documented restriction is not actually enforced in code.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The documentation says the free version is restricted to 720p resolution, but no code sets, validates, or constrains output resolution. The script delegates generation to external scripts and only inspects the resulting video with ffprobe after creation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script appends the full user-provided SCRIPT content to a persistent log file without notice, minimization, or sanitization. This can expose sensitive prompts, proprietary text, personal data, or secrets entered by users, especially on shared systems or where logs are collected, backed up, or read by other tools.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The natural-language content prominently forces a specific language presentation for the skill. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This manifest contains user-facing natural language in Chinese only, but does not indicate that the skill is region-specific or that users can choose another language. That can violate language/locale policy guidance when a skill implicitly forces a specific language without user opt-in.

Static analysis

No suspicious patterns detected.