Videogen

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 2.2.0

Overview

This appears to be a legitimate video-generation skill, but it deserves review because it can install packages, read a home-directory API key file, fetch arbitrary URLs, and send user content to outside services.

Install only if you are comfortable with a video pipeline that fetches web pages, calls external AI/TTS/video services, runs FFmpeg/npm/pip, and reads MiniMax credentials from your environment or ~/.openclaw/.env. Review or patch the auto-install behavior, avoid private URLs or confidential narration unless you accept provider transmission, and regenerate package locks with HTTPS registries before running npm install.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (25)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-c:a", "copy",
                        str(burned_path),
                    ]
                    burn_result = subprocess.run(burn_cmd, capture_output=True, text=True, timeout=120)
                    if burn_result.returncode == 0:
                        print(f"  ✅ 字幕烧录完成: {burned_path}")
                        final_path = burned_path

• Confidence: 82% confidence
• Finding: The subtitle burn-in command passes subtitle_path directly into FFmpeg's subtitles filter expression. FFmpeg filter arguments have their own parsing rules, so unescaped special characters in a path can break parsing or potentially reference unintended resources, making this more than a generic subprocess false positive.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-c:a", "copy",
        str(output_path),
    ]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if r.returncode == 0:
        return True

• Confidence: 81% confidence
• Finding: Although subprocess.run is called safely with an argument list, this specific ffmpeg invocation interpolates an untrusted subtitle path into the subtitles filter expression. FFmpeg filter arguments have their own parsing rules, so special characters in the subtitle filename can break parsing or alter filter behavior, making this more than a generic subprocess issue.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
    print("⚠️  requests 未安装，正在安装...")
    import subprocess
    subprocess.run([sys.executable, "-m", "pip", "install", "requests", "-q"], check=True)
    import requests

try:

• Confidence: 96% confidence
• Finding: The script automatically runs pip to install missing packages at runtime, which modifies the host environment and executes code fetched from package indexes. In an agent/skill context, this expands capability from content extraction to software installation, creating supply-chain and unauthorized-environment-change risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
    print("⚠️  beautifulsoup4 未安装，正在安装...")
    import subprocess
    subprocess.run([sys.executable, "-m", "pip", "install", "beautifulsoup4", "-q"], check=True)
    from bs4 import BeautifulSoup

try:

• Confidence: 96% confidence
• Finding: This subprocess call installs beautifulsoup4 during execution, which is an unnecessary privileged side effect for a URL extractor. Runtime package installation can pull unreviewed code from external sources and alter the system unexpectedly.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        try:
            import sys
            subprocess.run([sys.executable, "-m", "pip", "install", "openai", "-q"], check=True)
            import openai
        except Exception:
            return content

• Confidence: 94% confidence
• Finding: The optional summarization path also installs the openai package dynamically, again granting environment-modifying behavior unrelated to the core extraction task. In automation environments this can violate change-control expectations and introduce supply-chain exposure.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes use of environment variables, filesystem access, network fetching, and shell execution, but does not declare permissions or clearly constrain those capabilities. This creates a least-privilege and transparency problem: users and the host may invoke a skill with broader operational power than its manifest suggests, increasing the chance of unintended data access, command execution, or network use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose is video generation, but the documentation expands behavior into arbitrary URL scraping, summarization, transcription/semantic validation, subtitle generation, and Remotion/Node rendering workflows. This mismatch is dangerous because operators may trust the skill as a narrow media tool while it actually performs broader content ingestion and code/toolchain execution, enlarging the attack surface and reducing informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill supports extracting and summarizing content from arbitrary URLs, including general webpages, which goes beyond a simple video-generation pipeline. This increases exposure to untrusted remote content, prompt-injection-style input, legal/compliance issues around content reuse, and hidden network behavior that users may not expect from the skill’s stated scope.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The Remotion section introduces project code generation plus npm and rendering workflows, which is materially different from simply composing media with FFmpeg. Generating code and invoking package-management/build tooling expands execution risk, dependency exposure, and shell/network impact beyond what a user would infer from the skill description.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill reads credentials from a user-home .env file outside the skill workspace without explicit user action. That broadens the skill's access to sensitive local secrets and can surprise users who did not intend this component to harvest credentials from global configuration.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A content-extraction utility should not mutate the Python environment by installing packages on demand. This broadens the skill's behavior in a way that increases attack surface and operational risk, especially when run by agents with broad host access.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The summarization feature reads API keys from environment variables and transmits extracted article text to external LLM providers, which is materially broader than local URL extraction. This can leak sensitive or copyrighted content and secrets usage into third-party services without strong consent and controls.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger phrases are very broad common-language requests such as '做视频' and '生成视频', making accidental activation likely. In a skill with network access, file operations, shell execution, and external tool invocation, broad triggering is dangerous because ordinary user requests can unexpectedly launch a complex pipeline with remote fetches and local side effects.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill content is entirely in Chinese and does not indicate any mechanism to adapt to the user's preferred language or locale. This can cause incorrect triggering, poor user comprehension, and unsafe workflow execution when users expect another language, especially in an automation skill that generates publishable media output.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The lockfile hard-codes package downloads to `http://mirrors.tencentyun.com`, a third-party mirror over plaintext HTTP rather than the default authenticated npm registry endpoints. This weakens supply-chain integrity because package metadata and tarball URLs are pinned to a nonstandard mirror that can be tampered with in transit or controlled outside the user's expected trust boundary; in an automated video-generation skill, dependency installation is likely part of setup/build flows, increasing practical exposure.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The lockfile hard-codes package tarball downloads to `http://mirrors.tencentyun.com/...`, which disables transport security and permits dependency tampering via man-in-the-middle attacks. In a build pipeline for a video-generation skill, compromised packages could execute arbitrary code during install or build, making this a real software supply-chain risk rather than a harmless regional preference.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The scene explicitly states that the analysis tag is effectively embedded chain-of-thought, which normalizes or documents exposure of internal reasoning in output-facing content. Even though this is only UI text, in the context of an agent/video-generation skill it can encourage implementations or operators to surface hidden reasoning, increasing risk of prompt leakage, policy leakage, and disclosure of sensitive user-provided data included in analysis traces.

Vague Triggers

Medium

• Confidence: 99% confidence
• Finding: The lockfile pins package tarballs to plain HTTP URLs from a mirror, which removes transport-layer authenticity and confidentiality during dependency retrieval. Although npm integrity hashes help detect content tampering after download, HTTP still enables downgrade, interception, mirror substitution, metadata leakage, and disruption; in a build pipeline for a video-generation skill, a compromised dependency fetch could poison the local toolchain and affect all produced artifacts.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: The lockfile pins package downloads to plain HTTP mirror URLs, which removes transport-layer authenticity and confidentiality during dependency retrieval. Although integrity hashes provide some tamper detection, using HTTP still enables downgrade, interception, mirror manipulation, metadata leakage, and supply-chain risk—especially in automated build pipelines that fetch many packages.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill transmits user-provided narration text to external TTS services without any user-facing warning, consent step, or clear disclosure. In a video-generation workflow, narration may contain private, proprietary, or regulated content, so silent third-party transmission creates a real privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends up to 3000 characters of extracted page content to an external LLM API but provides no explicit warning at the point of use about off-box data transfer. In an agent workflow, users may reasonably assume extraction is local, so this creates a transparency and data-handling risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script executes a subprocess to run pip with only a minimal 'installing' message, not a substantive warning that it will modify the environment and fetch code from the network. While not stealthy, it still performs unexpected side effects that are risky in managed or sandboxed systems.

Ssd 3

Medium

• Confidence: 84% confidence
• Finding: The inclusion of '所有用户消息' ('all user messages') as a retained compression dimension semantically encourages collecting and carrying forward complete user content into summaries or compressed context. In an automation pipeline, this raises the chance of over-retaining sensitive user data, secrets, or unnecessary personal information beyond what is needed for the task.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The flow from '<analysis>' to '<summary>' plus the note that analysis formatting is stripped but remains embedded effectively describes converting hidden reasoning into output-adjacent content. This is dangerous because it blurs the boundary between private deliberation and externally consumable summaries, making accidental leakage of internal reasoning and user data more likely.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"-c:a", "copy",
        str(output_path),
    ]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if r.returncode == 0:
        return True

• Confidence: 84% confidence
• Finding: This is the one place where a user-influenced subtitle path is embedded into ffmpeg's filter language via f"subtitles={srt_path}". Even without shell=True, FFmpeg filter parsing can misinterpret special characters such as colons, quotes, commas, or brackets in paths, causing filter injection-like behavior, failed renders, or unintended file references.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.