OpenSora Video Prompt Architect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.0

Overview

The core prompt-writing skill is coherent, but its optional MCP setup runs unpinned third-party code from GitHub.

Use the text-only workflow freely, but treat the optional MCP as third-party executable code. Before installing it, review the referenced repository, prefer a pinned commit or signed release, remove automatic `-y` acceptance where possible, and run it with minimal filesystem and environment access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:80

Finding

Unpinned Third-Party MCP Package Enables Remote Payload Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 80–90
Vulnerability Type: Remote payload retrieval and execution through an unpinned GitHub dependency
Risk Level: High

Vulnerable Code

bash

openclaw mcp add opensora2 \
  --command npx \
  --arg -y \
  --arg github:gpt-img-2/opensora2-prompt-mcp \
  --include 'build_video_prompt,plan_shots,diagnose_prompt,get_resources'

The alternative installation path in the same section instructs users to execute:

bash

npx -y github:gpt-img-2/opensora2-prompt-mcp

Technical Analysis

The Skill instructs users to execute an MCP package directly from a GitHub repository through npx. The dependency is identified only by its mutable repository name and is not pinned to an immutable commit hash or a reviewed, integrity-verified release.

Consequently, the code executed at installation or startup can differ from the code originally reviewed. The -y option automatically accepts the npx installation prompt, reducing the opportunity for users to notice or reject an unexpected package download.

The MCP implementation is not included in the audited project, which contains only SKILL.md. Therefore, the document's claim that the MCP provides deterministic, read-only helpers cannot be independently verified from the available artifact.

Attack Path

1. An attacker compromises the referenced GitHub account or repository, obtains permission to modify it, or compromises its dependency or release pipeline.
2. The attacker adds malicious package lifecycle logic, startup code, or MCP handler code to the repository.
3. A user follows the Skill's documented setup instructions or starts a previously configured MCP server.
4. npx -y github:gpt-img-2/opensora2-prompt-mcp retrieves the repository's current, attacker-controlled revision without requiring confirmation.
5. The malicious package executes with the privileges and environment of the user running OpenClaw or npx.
6. The payload c ...[truncated 876 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the GitHub dependency to a reviewed immutable commit hash rather than a mutable repository reference.
2. Prefer a versioned package distributed through a trusted registry with lockfile and integrity-hash verification.
3. Remove -y from user-facing installation instructions so package retrieval is not accepted automatically.
4. Vendor the reviewed MCP source in the Skill package or provide reproducible-build instructions and signed release artifacts.
5. Document the expected commit hash, package checksum, publisher identity, and verification commands.
6. Audit package lifecycle scripts and the complete transitive dependency graph before recommending execution.
7. Run the MCP in a sandbox with minimum filesystem, environment-variable, tool, and network access.
8. Separate installation from execution and require explicit user approval before updating to a different revision.
9. Add an update policy requiring security review whenever the pinned revision or dependency set changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to install and run an MCP server directly from a GitHub reference via npx -y github:... without pinning a commit, tag, version, or integrity value. That creates a software supply-chain risk: if the referenced repository is changed, compromised, retagged, or its dependency tree becomes malicious, users may execute attacker-controlled code locally when following the skill's setup steps.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

- Text-to-video: https://opensora2.com/text-to-video
- Image-to-video: https://opensora2.com/image-to-video
- Video-to-video: https://opensora2.com/video-to-video
- Raw Skill: https://opensora2.com/skills/opensora-video-prompt-architect/SKILL.md
- MCP source: https://github.com/gpt-img-2/opensora2-prompt-mcp
- ClawHub listing: https://clawhub.ai/gpt-img-2/skills/opensora-video-prompt-architect

Static analysis

No suspicious patterns detected.