Security audit

motion-takeover-f100k

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Spanish video-production helper whose file, rendering, and external-media steps mostly match its stated purpose, with some setup and boundary clarity issues users should notice.

Install only if you want a Spanish workflow for creating YouTube motion takeovers. In OpenClaw, keep it to the stated mode: use the user's SRT and screenshot, approve the motion board before paid generation, and deliver assets rather than composing over the original video. Review any optional global installs and prefer vendoring or pinning the GSAP dependency if rendering in a sensitive environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The OpenClaw-specific block states that rendering/composition steps do not run in this agent, yet the rest of the document provides a full pipeline for generating a composed final video. In an agent environment, conflicting execution boundaries can lead to accidental execution of disallowed steps, tool misuse, or operators assuming a safer scope than the skill actually defines.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims that in this agent it does not edit or compose the user's video, but later operational instructions describe producing a final `video_final.mp4` through rendering and ffmpeg composition. This kind of contradiction is dangerous because it can cause the agent or reviewer to misunderstand the actual privileges and outputs of the skill, leading to unauthorized media processing and reduced trust in safety boundaries.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: A language/locale policy violation applies to all file types when a skill effectively forces a specific language without user choice. The manifest description is fully Spanish and includes activation phrases only in Spanish, which can constrain use for users expecting another language.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The activation and non-activation guidance is entirely expressed in Spanish and does not indicate that other languages are supported. This creates a natural-language policy concern because invocation appears tied to a single language/locale without opt-in or justification.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: This HTML template contains natural-language comments and visible UI text in Spanish throughout, including the on-screen labels and instructions. Under the policy rule for language or locale violations, forcing a specific language without user opt-in or justification is a natural-language policy concern.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The template loads executable JavaScript from a third-party CDN at runtime, which introduces a supply-chain and integrity risk. If the CDN response is tampered with, blocked, or changed unexpectedly, any renderer opening this HTML could execute untrusted code, which is more dangerous because this skill is a local rendering/template aid and does not need network-fetched code to function safely.

Static analysis

No suspicious patterns detected.