ClawHub
Back to skill

Security audit

china-video-prompt-architect

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent video-prompt helper, but its optional setup asks users to run an unpinned GitHub MCP server with local code execution.

Install the text skill only if you are comfortable with its prompt-writing purpose. Treat the MCP setup as higher risk: prefer skipping it, or only run it after pinning and reviewing a specific commit and restricting filesystem, environment-variable, credential, and network access for the MCP process.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:84
Finding

Unpinned GitHub Dependency Is Downloaded and Executed with npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84–94
Vulnerability Type: Unpinned remote dependency execution
Risk Level: High

Vulnerable Code

bash
On OpenClaw releases that expose the `mcp` command group, connect the stdio server with:

openclaw mcp add chinavideoai \
  --command npx \
  --arg -y \
  --arg github:gpt-img-2/chinavideoai-prompt-mcp \
  --include 'build_video_prompt,plan_reference_shots,diagnose_video_prompt,get_china_video_resources'

The alternative installation instruction has the same underlying issue:

text
npx -y github:gpt-img-2/chinavideoai-prompt-mcp

Technical Analysis

The skill instructs users to execute a package directly from a mutable GitHub repository reference. No immutable commit hash, signed release, version tag, package lock, or verified integrity digest is specified. The npx -y option automatically accepts installation, reducing the opportunity for the user to inspect the downloaded component before execution.

Because the repository reference can resolve to different code over time, the component executed by a user may differ from the component reviewed during this audit. A compromise of the repository, maintainer account, dependency chain, or referenced default branch could therefore introduce attacker-controlled code. The process would execute that code under the account running OpenClaw or the setup command.

Attack Path

  1. An attacker compromises the referenced GitHub repository, a maintainer account, or a transitive dependency used by the MCP package.
  2. The attacker modifies the repository's default branch or installation lifecycle code with a malicious payload.
  3. A user follows the instructions in SKILL.md and runs the supplied OpenClaw or direct npx -y command.
  4. npx retrieves the current remote repository contents without verifying an audit-approved immutable revision.
  5. The downloaded package or its insta ...[truncated 929 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the GitHub dependency to a reviewed immutable commit SHA rather than its mutable default branch.
  2. Prefer a versioned package from a trusted registry with a lockfile and an explicitly verified cryptographic integrity digest.
  3. Remove -y so installation requires explicit user confirmation and provides an opportunity to inspect the resolved source.
  4. Review and archive the exact source revision, including its transitive dependencies and installation lifecycle scripts.
  5. Verify release signatures or attestations where available, and document the expected repository owner, revision, and checksum.
  6. Run the MCP server in a sandbox with restricted filesystem, credential, environment-variable, and network access.
  7. Configure dependency monitoring and require security review before updating the pinned revision.
  8. Present the MCP as an optional external component and warn users that installation executes third-party code under their account.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs users to install and run an MCP server directly from a GitHub repository via npx -y github:gpt-img-2/chinavideoai-prompt-mcp without pinning to a specific commit, tag, or package version. This creates a supply-chain risk: repository changes, account compromise, or a malicious force-push could cause different code to execute later under the same command, and the skill normalizes executing that code locally as part of setup.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
- Image-to-video: https://chinavideoai.com/image-to-video
- Video-to-video: https://chinavideoai.com/video-to-video
- Reference-to-video guide: https://chinavideoai.com/blog/seedance-25-reference-to-video-guide
- Raw Skill: https://chinavideoai.com/skills/china-video-prompt-architect/SKILL.md
- MCP source: https://github.com/gpt-img-2/chinavideoai-prompt-mcp
- ClawHub listing: https://clawhub.ai/gpt-img-2/skills/china-video-prompt-architect

Static analysis

No suspicious patterns detected.