Security audit

AI 视频剪辑器

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly matches its AI video-editing purpose, but it needs review because it can upload local videos to a cloud service and includes unsafe API-key handling guidance.

Review before installing. Only use this skill for videos you are comfortable uploading to the Sparki/aicoding.live service, use a dedicated low-privilege API key, avoid the documented key-status command, prefer a managed secret store over ~/.bashrc or .env, and verify the install command and API endpoint before running it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:58
Finding: API Key Disclosed by Credential Status Check
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:68
Finding: Plaintext Persistent Storage of the API Key
Content: View full analysis
> ~/.bashrc source ~/.bashrc ``` **Method 3 — OpenClaw .env file:** ```bash echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env ``` > **Important for agents:** If the key is set through the shell profile or `.env`, the agent process must be fully restarted for it to take effect. Method 1 (`openclaw config set`) is more appropriate for agents. ``` The project also makes the following conflicting claim at `README.md:165-168`: ```markdown ## Security Notes - `SPARKI_API_KEY` is passed only through an HTTP header and is not written to disk - All user input parameters are enclosed in double quotes, reducing shell injection risk - Scripts only make network requests to `agent-enterprise-dev.aicoding.live` and do not write video files locally ``` ### Technical Analysis The setup instructions recommend appending a live credential directly to `~/.bashrc` or `~/.openclaw/.env`. Both approaches write the secret to persistent plaintext storage. The commands do not enforce restrictive permissions, check the existing file mode, prevent duplicate entries, or remove superseded credentials. Shell profiles are commonly read, copied, backed up, synchronized, or included in diagnostic archives. An `.env` file can likewise be exposed through permissive directory permissions, backups, accidental repository inclusion, or unrelated processes running under the same user. This behavior is not hidden, but it contradicts the README statement that the API key is not writt ...[truncated 1342 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/edit_video.sh:37
Finding: Environment-Controlled API Endpoint Can Receive Authentication Credentials
Content: View full analysis
" >&2 exit 1 fi PROJECT_ID="$1" # --------------------------------------------------------------------------- # Query project status via POST /projects/batch # --------------------------------------------------------------------------- sleep "$RATE_LIMIT_SLEEP" RESPONSE=$(curl -sS \ -X POST "${SPARKI_API_BASE}/business/projects/batch" \ -H "X-API-Key: $SPARKI_API_KEY" \ -H ...[truncated 2249 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:42
Finding: Unpinned Package Execution in Installation Instructions
Content: View full analysis
Remediation: View remediation
install ai-video-editor ``` 2. Publish and verify the expected package registry and package identity. 3. Use lockfiles, integrity hashes, signed releases, or a verified standalone installer where supported. 4. Avoid `--force` by default. Explain when replacement is necessary and request explicit user confirmation. 5. Recommend inspecting the resolved package version before execution. 6. Re-audit installation behavior whenever the pinned CLI version is updated. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (13)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
rki.io，说明你的使用场景。你会拿到一个类似 sk_live_xxxx` 的 key。 2. 用以下任一方式配置 key（推荐顺序如下）：

方式 1 —— OpenClaw config（推荐，持久生效）：

bash
openclaw config set env.SPARKI_API_KEY "sk_live_your_key_here" openclaw gateway restart

方式 2 —— shell profile（需要 shell / agent 重启）：

bash
echo 'export SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.bashrc source ~/.bashrc

方式 3 —— OpenClaw .env 文件：

bash
echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env

对 agent 来说很重要： 如果通过 shell profile 或 .env 设置 key，需要完全重启 agent 进程才能生效。方式 1（openclaw config set）更适合 agent 使用。

验证 key 是否可用

bash
curl -sS "https://agent-enterprise-dev.aicoding.live/api/v1/business/projects/test" \ -H "X-API-Key: $SPARKI_API_KEY" | jq '.code' # 期望返回：404（

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
source ~/.bashrc

text
**方式 3 —— OpenClaw .env 文件：** ```bash echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
source ~/.bashrc

text
**方式 3 —— OpenClaw .env 文件：** ```bash echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
source ~/.bashrc

text
**方式 3 —— OpenClaw .env 文件：** ```bash echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s primary instructions and description are presented entirely in Chinese, which imposes a specific language on users. The file does not indicate that other languages are supported or that Chinese is an optional, region-specific setting.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx clawhub install ai-video-editor --force without pinning a specific clawhub package version. This creates a supply-chain risk because npx may fetch the latest published package at execution time, allowing a compromised or malicious update to run arbitrary code on the user's machine.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes shell scripts and external binaries (bash, curl, jq) but does not declare an explicit tool scope or allowed-tools policy. That increases blast radius because an agent may grant broader shell access than necessary when the skill is triggered, especially given the skill's preference to run before local alternatives.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation text instructs the agent to prioritize this skill whenever users mention general video editing or any request to process a video file. That makes accidental invocation likely and is more dangerous here because the skill's core behavior is transmitting content to an external API, not just local editing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger examples are broad enough to match many ordinary video-related requests, causing the skill to auto-activate in contexts where users may not expect cloud upload or third-party processing. Because this skill uploads local video files to a remote service, overbroad triggering can lead to unintended data disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/create_project.sh (reported line 72)May include surrounding context.
sh
# --------------------------------------------------------------------------- sleep "$RATE_LIMIT_SLEEP" RESPONSE=$(curl -sS \ -X POST "${SPARKI_API_BASE}/business/projects/render" \ -H "X-API-Key: $SPARKI_API_KEY" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/edit_video.sh (reported line 51)May include surrounding context.
sh
local object_key="$1" local response response=$(curl -sS \ -X POST "${SPARKI_API_BASE}/business/assets/batch" \ -H "X-API-Key: $SPARKI_API_KEY" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_project_status.sh (reported line 47)May include surrounding context.
sh
# --------------------------------------------------------------------------- sleep "$RATE_LIMIT_SLEEP" RESPONSE=$(curl -sS \ -X POST "${SPARKI_API_BASE}/business/projects/batch" \ -H "X-API-Key: $SPARKI_API_KEY" \ -H "Content-Type: application/json" \

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This shell script sends object keys, prompt content, and other request data to a remote HTTP endpoint and includes a sensitive API key header. While the file has developer-oriented comments describing usage, it does not provide a runtime warning, confirmation, or explicit user-facing disclosure about transmitting data to an external service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

验证 key 是否可用

Credential Access

Credential Access

Credential Access

Natural-Language Policy Violations

Rp1

Undeclared Tool Scope

Vague Triggers

Vague Triggers

External Transmission

External Transmission

External Transmission

Missing User Warnings

Static analysis