Video Download Archive

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:22 AM UTC
• Version: 1.0.0

Overview

The skill’s video-download purpose is coherent, but it writes detailed user/video metadata to a fixed Feishu table and executes an unaudited helper outside the reviewed package.

Review before installing. Use this only if you intend to download videos locally and write records to the specific Feishu Bitable embedded in the skill. Avoid private, signed, internal, or token-bearing URLs, and do not run it unless the external ytfetch.sh helper is present, trusted, and under your control. Prefer a version that lets you configure the Feishu destination, previews fields before writing, omits absolute local paths, and packages all executable helpers inside the reviewed skill.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_video_archive.py:208

Finding

Fixed Feishu destination receives sensitive local filesystem metadata

Content

View full analysis

Vulnerability Details

File Location: scripts/run_video_archive.py:5-6, 208-228, 237-245; workflow.md:40-57; bitable-mapping.md:4, 45
Vulnerability Type: Hard-coded external destination and unnecessary disclosure of local filesystem information
Risk Level: Medium

Complete Code Snippet

python

BITABLE_APP_TOKEN = "KMuEbR5b5aLXFosyxGlc7kTenpb"
BITABLE_TABLE_ID = "tblz1kx1SjpO9QnV"

python

fields = {
    "视频主键": meta["video_key"],
    "视频标题": meta["title"],
    "视频唯一ID": meta["video_key"],
    "上传者": meta["uploader"],
    "上传者@handle": meta["uploader_handle"],
    "上传者主页URL": {"text": meta["uploader_url"], "link": meta["uploader_url"]} if meta["uploader_url"] else None,
    "时长(秒)": float(meta["duration"]) if meta["duration"] else None,
    "文件大小(字节)": float(stat.st_size),
    "分辨率": media.get("resolution") or None,
    "帧率(FPS)": media.get("fps"),
    "视频编码": media.get("codec") or None,
    "总码率(kbps)": media.get("kbps"),
    "来源": meta["site"],
    "标签": meta["tags_text"] or None,
    "简介描述": meta["description"] or None,
    "下载的URL": {"text": meta["url"], "link": meta["url"]},
    "下载时间": now_ms,
    "下载地址": file_path,
    "备注": None,
}

output = {
    "ok": True,
    "meta": meta,
    "file_path": file_path,
    "file_size": stat.st_size,
    "info_json": info_json,
    "bitable": {"app_token": BITABLE_APP_TOKEN, "table_id": BITABLE_TABLE_ID},
    "record_fields": fields,
}
print(json.dumps(output, ensure_ascii=False))

The workflow subsequently directs the Agent to submit record_fields to the identified Feishu table:

markdown

## Step 5: Write to Feishu
### If a record already exists
Call:
- `feishu_bitable_app_table_record.update`

### If no record exists
Call:
- `feishu_bitable_app_table_record.create`

Write:
- Use the `record_fields` emitted by the script

Technical Analysis

The Skill embeds a s ...[truncated 2441 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the fixed Bitable identifiers from source code.
2. Require the user or deployment administrator to provide the app token and table ID through explicit configuration.
3. Display the resolved Feishu destination and request confirmation before the first remote write.
4. Validate that the destination belongs to the expected tenant or account when the platform API supports such verification.
5. Remove file_path from remote records by default. If location tracking is necessary, use only a relative archive path, sanitized filename, or opaque local record identifier.
6. Present a preview of all remotely transferred fields and allow the user to omit descriptions, tags, URLs, and other potentially sensitive metadata.
7. Document the exact data categories sent to Feishu and the retention implications.
8. Treat resource identifiers as deployment configuration even when they are not authentication secrets.

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/run_video_archive.py:170

Finding

Execution of an unaudited mutable helper outside the Skill package

Content

View full analysis

Vulnerability Details

File Location: scripts/run_video_archive.py:8, 17-19, 170-186
Vulnerability Type: External local tool trust and execution boundary violation
Risk Level: Medium

Complete Code Snippet

python

YTFETCH = "/home/jianhao/.openclaw/workspace/scripts/ytfetch.sh"

python

def run(cmd):
    p = subprocess.run(cmd, text=True, capture_output=True)
    return p.returncode, p.stdout, p.stderr

python

def do_download(url):
    rc, out, err = run([YTFETCH, url])
    text = (out or "") + "\n" + (err or "")
    pairs = {}
    for line in text.splitlines():
        if "=" in line and re.match(r"^[A-Z0-9_]+=", line):
            k, v = line.split("=", 1)
            pairs[k.strip()] = v.strip()
    existing = pairs.get("EXISTING_FILE")
    updated = pairs.get("UPDATED_FILE")
    target_dir = pairs.get("TARGET_DIR")
    vid = pairs.get("VIDEO_ID")
    chosen = updated or existing
    if not chosen and target_dir and vid:
        chosen, _ = find_existing({"folder": os.path.basename(target_dir), "video_id": vid})
    if rc not in (0, 11, 12) and not chosen:
        fail("下载失败")
    info_json = None
    if target_dir and vid:
        _, info_json = find_existing({"folder": os.path.basename(target_dir), "video_id": vid})
    return {"file": chosen, "info_json": info_json, "raw": text, "status_code": rc}

Technical Analysis

The script executes /home/jianhao/.openclaw/workspace/scripts/ytfetch.sh, an absolute path outside the audited Skill package. The referenced helper is not present in the supplied project structure, so its implementation, integrity, permissions, and network behavior cannot be reviewed.

This creates a mutable execution boundary: the effective behavior of the Skill can change without any modification to the reviewed package. Any process or user capable of replacing or modifying that helper can cause arbitrary commands to ex ...[truncated 1775 chars]

Remediation

View remediation

Remediation Suggestions

1. Include ytfetch.sh inside the audited Skill package.
2. Resolve the helper relative to the current script rather than through an author-specific absolute path:

   python

   YTFETCH = Path(__file__).resolve().parent / "ytfetch.sh"
   

3. Audit the packaged helper for network access, credential use, command injection, destructive operations, and unsafe file handling.
4. Before execution, verify that the helper is a regular file, is not a symbolic link, and is not writable by untrusted users.
5. Use package signing or an integrity hash when the deployment model permits it.
6. Fail closed if the helper is missing or its integrity cannot be established.
7. Correct the documentation so that the declared helper path and implementation are identical.
8. Consider replacing the shell helper with directly audited Python subprocess calls using fixed argument arrays.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/run_video_archive.py:21

Finding

Unrestricted URL handling allows requests to internal network resources

Content

View full analysis

Vulnerability Details

File Location: scripts/run_video_archive.py:21-25, 115-119, 190-196
Vulnerability Type: Server-side request forgery and internal network access
Risk Level: Low to Medium

Complete Code Snippet

python

def valid_url(url):
    try:
        u = urllib.parse.urlparse(url)
        return u.scheme in {"http", "https"} and bool(u.netloc)
    except Exception:
        return False

python

def parse_meta(url):
    rc, out, err = run(["yt-dlp", "--dump-single-json", "--no-warnings", url])
    if rc != 0 or not out.strip():
        fail("不是可下载视频，或 yt-dlp 无法提取元数据")

python

if __name__ == "__main__":
    if len(sys.argv) != 2:
        fail("用法: run_video_archive.py <url>")
    url = sys.argv[1].strip()
    if not valid_url(url):
        fail("不是合法 URL")

    meta = parse_meta(url)

Technical Analysis

URL validation only verifies that the scheme is HTTP or HTTPS and that a network location is present. It does not reject:

• Loopback destinations such as 127.0.0.1 or ::1
• Private network ranges
• Link-local destinations
• Reserved or multicast ranges
• Hostnames that resolve to internal addresses
• Public URLs that redirect to internal resources
• DNS rebinding scenarios where resolution changes between validation and connection

The accepted URL is passed to yt-dlp, which performs network requests from the Agent host. Public network access is necessary for the declared video-download function, but access to local services and private network destinations is not required and exceeds least-network-privilege expectations.

Exploitability depends on whether yt-dlp can process or retrieve useful content from the selected endpoint, how it follows redirects, and what internal services are reachable from the host.

Attack Path

1. An attacker supplies a URL using an internal IP address, internal hostname, or attacker-contro ...[truncated 1185 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an allowlist of explicitly supported public video platforms.
2. Resolve hostnames before making requests and reject every resolved address that is loopback, private, link-local, multicast, unspecified, or reserved.
3. Apply equivalent checks to IPv4 and IPv6 addresses.
4. Revalidate every redirect target before following it.
5. Protect against DNS rebinding by ensuring the connected address matches a previously validated public address or by enforcing network-layer egress controls.
6. Explicitly block cloud metadata and link-local ranges.
7. Run download operations in a sandbox with outbound access restricted to approved public destinations.
8. Apply connection, read, and total-operation timeouts to reduce scanning and denial-of-service potential.
9. Log rejected destination classes without disclosing sensitive internal network details to untrusted callers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly relies on a local Python script to fetch remote content with yt-dlp and to write records via a Feishu tool, which implies shell execution and network access, yet the manifest does not declare any tool scope restrictions such as permissions or allowed-tools. This creates an authorization gap: an agent runtime may grant broader capabilities than intended, making it harder to enforce least privilege or to safely review what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document requires writing the original input URL directly to the archive record. Video URLs can contain private share tokens, tracking parameters, signed access parameters, unlisted-resource locators, or other sensitive query strings; persisting them without sanitization can leak access-bearing links or user-specific metadata to anyone who can access the Bitable. Because this skill is specifically designed to archive externally supplied URLs, this data flow is central to the workflow and increases the likelihood of exposing sensitive links.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The mapping explicitly requires storing the local final file path in Feishu Bitable. Local paths can disclose hostnames, usernames, directory structures, mount points, or internal storage layouts, which creates unnecessary environment leakage and can aid later targeting or reveal sensitive workstation/server details. In this skill context, the path is being exported into an external record system, which makes the exposure more dangerous than keeping it transiently in local logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The operational instructions are entirely written in Chinese and do not indicate that language selection is optional or limited to a justified region-specific deployment. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_video_archive.py (reported line 17)May include surrounding context.

python

def run(cmd):
    p = subprocess.run(cmd, text=True, capture_output=True)
    return p.returncode, p.stdout, p.stderr

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script automatically invokes a downloader script on a user-supplied URL and can cause network access, file writes, and execution of external tooling without any explicit disclosure or confirmation. In an agent-skill context, this is risky because users may not realize the skill will fetch remote content and persist files locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script emits structured output containing extracted metadata and the full local file path, and also includes Bitable identifiers, without warning the user that local filesystem details will be exposed to downstream consumers. In an agent environment, that can leak privacy-sensitive information such as usernames, directory structure, and downloaded content metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow explicitly performs local downloads and remote Feishu Bitable writes, but it does not require a user-facing confirmation or warning before these side effects occur. In an agent setting, this can cause unintended modification of local storage and third-party records from a single URL input, increasing the risk of surprise writes, misuse, or accidental data handling without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Several error and usage messages are written only in Chinese, such as the download and parsing failure messages. This imposes a specific language on users without any opt-in, fallback, or locale selection, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's operational instructions are entirely in Chinese, with no indication that language choice is optional or that the skill is intentionally region-specific. This can violate the language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.