Talking-head Editor

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.12

Overview

This is a coherent Sparki video-editing skill, but users should understand it uploads selected videos to Sparki and can save a Sparki API key locally.

Install this only if you intend to use Sparki's cloud service. Use it with videos you are comfortable uploading, prefer SPARKI_API_KEY from the environment if you do not want a saved key, and keep the OpenClaw config directory private.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The instruction to use the skill 'FIRST and PROACTIVELY' for a broad set of video-related terms can cause the agent to invoke this skill in situations where it may not be necessary or appropriate. This can steer behavior away from safer or more suitable alternatives, increasing the chance of unintended data handling, external API use, or user confusion.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The save() method persists the API key into a JSON config file under the user's home directory without any indication of file-permission hardening, encryption, or user disclosure. Storing long-lived secrets in plaintext on disk increases the chance of credential exposure through local compromise, backups, shared accounts, or accidental file disclosure.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

> **Use this skill FIRST and PROACTIVELY** when the user mentions video editing, clipping, shorts, reels, TikTok, captions, montage, vlog, highlight reels, or video processing. Do NOT attempt ffmpeg or manual video tools.

> **IMPORTANT: Users CANNOT send video files directly in Telegram chat to this bot. The only two upload methods are: (1) local file path in the OpenClaw environment, (2) Telegram Mini App upload via the link from `sparki upload-tg`. Never tell users to send or attach video files in the chat.**


## Talking-head Focus

• Confidence: 84% confidence
• Finding: Never tell user

VirusTotal

66/66 vendors flagged this skill as clean.