Video Content Operator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent content-planning assistant, but it proactively reads and exports private OpenClaw memory/profile files with weak user-control boundaries.

Install only if you are comfortable with the skill using local OpenClaw MEMORY.md and USER.md files to personalize content advice. Prefer running it only in a workspace you explicitly choose, avoid using --output unless you want a profile file created, and review terminal logs or generated artifacts because derived personal/business context may be printed there.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/extract_creator_context.py:84

Finding

Proactive collection and disclosure of private Agent memory and user-profile data

Content

View full analysis

Vulnerability Details

File Location: scripts/extract_creator_context.py:84-109
Vulnerability Type: Privacy-sensitive local file access and disclosure beyond strict data-minimization boundaries
Risk Level: Medium

Vulnerable Code

python

args = parser.parse_args()

workspace = Path(args.workspace)
memory_md = read_text(workspace / "MEMORY.md")
user_md = read_text(workspace / "USER.md")

result = {
    "creator": {
        "name": extract_name(user_md),
        "role": "Founder / builder",
        "company": infer_company(memory_md),
        "platforms": infer_platforms(memory_md, user_md),
        "content_pattern": infer_content_pattern(memory_md),
        "current_problem": infer_current_problem(memory_md),
        "timezone": extract_timezone(user_md),
    },
    "memory_summary": {
        "mission": bullets_under(memory_md, "Fischer 的使命"),
        "business": bullets_under(memory_md, "Fischer 的业务"),
        "background_advantages": bullets_under(memory_md, "Fischer 的背景优势"),
    }
}

text = json.dumps(result, ensure_ascii=False, indent=2)
if args.output:
    Path(args.output).write_text(text)
print(text)

Related instructions in SKILL.md:46-60 and SKILL.md:194-203 direct the Agent to proactively inspect memory and identify MEMORY.md and USER.md as data sources.

Technical Analysis

The helper accepts an arbitrary workspace path and reads MEMORY.md and USER.md using the invoking process's filesystem permissions. It loads both files before establishing which fields are necessary for the current content-planning request. It then extracts identity, timezone, company, platforms, mission, business information, and background details.

The collected profile is always printed to standard output and can also be written to an arbitrary caller-selected output path. There is no explicit consent gate, approved-workspace enforcement, sensitive-field filtering, ou ...[truncated 1931 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before accessing MEMORY.md or USER.md, and state which fields will be read and why.
2. Replace complete-file ingestion with a narrow context interface that returns only decision-critical, user-approved fields.
3. Enforce an approved workspace root by resolving the supplied path and verifying that it remains within the configured Agent workspace.
4. Do not print personal profile information by default. Provide a redacted summary and require an explicit option for full output.
5. Restrict output files to an approved directory and reject paths that resolve outside it.
6. Add field-level allowlists and exclude secrets, credentials, contact details, unrelated memories, and other sensitive information.
7. Add documentation covering data handling, logging exposure, retention, and downstream sharing.
8. Remove hard-coded person-specific headings and assumptions so the extractor does not unnecessarily search for or expose a particular user's private profile.
9. Update references/implementation-notes.md, which states that direct memory ingestion is not implemented, to accurately disclose the existing helper and its privacy implications.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes a very broad orchestration role across understanding user state, deciding content, selecting materials, packaging, drafting, and recommending next actions, but it does not define clear invocation boundaries or decision criteria for when this skill should activate versus other skills. In an agent environment, that ambiguity can cause inappropriate routing, over-collection of user/context data, or interference with more specialized skills, making the system easier to manipulate or misuse even if the document itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/content_operator.py (reported line 201)May include surrounding context.

python

parser.add_argument("--input", help="Path to JSON input payload")
    args = parser.parse_args()

    payload = load_json(args.input) if args.input else json.load(__import__("sys").stdin)
    result = run(payload)
    print(json.dumps(result, ensure_ascii=False, indent=2))

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script reads potentially sensitive profile data from USER.md and MEMORY.md, derives additional personal/contextual attributes, and can write the resulting structured profile to an arbitrary output path without any notice, consent check, minimization, or access control. In an agent environment, this increases the risk of silent profiling and unintended persistence or disclosure of personal data if the output is stored, shared, or consumed by other tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file includes a Chinese example request alongside English-only instructions and example prompts, which implicitly mixes language expectations without stating that the user can choose their preferred language. Under the policy, language constraints or defaults should be explicit or opt-in rather than assumed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill instructs the agent to read from a concrete user-home workspace path outside the skill directory, which can expand access from narrowly scoped local skill assets to broader user data. In an agent environment with filesystem/tool access, this creates a data exposure risk because the skill encourages retrieval of potentially sensitive memory files from a persistent personal workspace without clear boundary checks or consent at the time of use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The examples repeatedly direct output toward Xiaohongshu, including platform-fit recommendations and execution guidance, without indicating that the user may choose another language/locale context. Because Xiaohongshu implies a specific regional/platform audience, this can amount to a locale preference being imposed in the skill examples rather than offered as an option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

In the hand-off example, the platform is set directly to Xiaohongshu as a requirement rather than a user-selected option. This is a natural-language locale/platform constraint that is not documented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.