ClawHub
Back to skill

Security audit

文生图视频生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent media-generation workflow, but users should know it uploads selected assets and generation data to third-party services.

Install only if you are comfortable sending generation prompts, task metadata, and one asset image from the skill's assets folder to Alibaba Cloud OSS and the referenced aggregation API. Keep sensitive or proprietary images out of that assets directory unless you intend to upload them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs uploading a local asset image from the workspace to Alibaba Cloud OSS, but it provides no user consent flow, data classification guidance, or warning that local files will be transferred to a third-party cloud service. Because the assets directory may contain sensitive or proprietary images, this creates a real privacy and data-governance risk through unintended external disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill directs the agent to send generation requests to an external API endpoint, which means user prompts and possibly metadata or asset-derived content leave the local environment. In this skill's context, that risk is heightened because the workflow also references local materials and structured script content, yet gives no notice, trust boundary description, or minimization of what is transmitted.

Content

Scanner excerpt · skill.md (reported line 31)May include surrounding context.

md
### 3. 调用生成脚本
参考资料"防汛脚本20260309.xlsx"，资料中每一行，对应生成一个视频，每次生成一个，根据用户提示词确定生成哪一个。生成视频时，按具体行对视频要求来生成

调用聚合平台接口生成，接口参考：https://api.wuyinkeji.com/doc/60。
生成时长默认15秒，视频清晰度默认large。

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Polling or querying an external results API is itself an external transmission and may expose task identifiers, generated-content metadata, and usage patterns to a third party. While lower risk than direct file upload, it still extends the data boundary outside the local system without any privacy notice or user control.

Content

Scanner excerpt · skill.md (reported line 36)May include surrounding context.

md
### 4. 查看结果
调用聚合平台接口查看结果，接口参考：https://api.wuyinkeji.com/doc/36

生成的视频保存在：`/home/xihu/.openclaw/workspace/output/<标题>.mp4`，标题来源“防汛脚本20260309.xlsx”

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The natural-language instructions require generated content to depict a specific location in China, Beijing's Miyun District, as a fixed constraint. Because the policy category covers language/locale-style forced regional constraints, this is a potential policy issue unless the region-specific limitation is explicitly justified or offered as an opt-in choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.