OXVODO Motion Prompt Architect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:17 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a prompt-writing workflow, but its optional MCP setup runs an unpinned GitHub package, so it should be reviewed before use.

The text-only prompt workflow appears reasonable to use. Treat the optional MCP setup as higher risk: only run it if you trust the publisher and source repository, prefer a pinned audited commit or release, and run it with minimal filesystem, environment, and credential exposure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66

Finding

Unpinned Remote MCP Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-79
Vulnerability Type: Remote payload retrieval and execution through a mutable GitHub dependency
Risk Level: High

bash

Connect the stdio server with:

```bash
openclaw mcp add oxvodo \
  --command npx \
  --arg -y \
  --arg github:gpt-img-2/oxvodo-prompt-mcp \
  --include 'build_motion_prompt,plan_reference_sequence,diagnose_media_prompt,get_oxvodo_resources'

Then run openclaw mcp doctor oxvodo --probe. If the installed release lacks the mcp command group, add npx -y github:gpt-img-2/oxvodo-prompt-mcp as a Stdio server in MCP settings. The MCP is optional; never imply it ran when unavailable.

text

### Technical Analysis

The installation instructions cause `npx` to retrieve and execute code directly from the mutable GitHub repository `gpt-img-2/oxvodo-prompt-mcp`. The dependency is not pinned to an immutable commit SHA, exact verified release, or integrity digest. As a result, the code executed by future users can differ from the code reviewed during this audit.

The `-y` option automatically accepts the installation prompt, reducing the opportunity for users to inspect or reject the retrieved package. Package installation hooks and the MCP server process may execute arbitrary code under the privileges of the user running OpenClaw. Although the MCP integration is documented as optional and no malicious payload is embedded in the audited file, the command establishes a remote code-execution channel controlled by an external repository.

### Attack Path

1. An attacker compromises the referenced GitHub repository, its maintainer account, or the dependency publication workflow, or a malicious upstream update is introduced.
2. The attacker modifies the repository package, entry point, installation hook, or transitive dependencies to include malicious code.
3. A user follows the instructions in `SKILL.md` and runs the supplied `openclaw m
...[truncated 1150 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the GitHub dependency to a reviewed, immutable full commit SHA rather than a branch or repository default:

   bash

   npx github:gpt-img-2/oxvodo-prompt-mcp#FULL_AUDITED_COMMIT_SHA
   

2. Prefer publishing the MCP package through a trusted registry and require an exact version rather than a range or floating tag.
3. Distribute and verify cryptographic checksums, provenance attestations, or signed releases before execution.
4. Remove -y so users must explicitly approve package retrieval and can review the resolved source and version.
5. Pin and audit transitive dependencies with a committed lockfile, and use automated dependency and provenance scanning in the release process.
6. Run the MCP server in a sandbox with minimal filesystem access, a restricted environment, no unnecessary credentials, and limited outbound network access.
7. Document the package's required permissions and data boundaries so operators can apply least privilege.
8. Require users to review the pinned source before configuring it as a persistent Stdio server, and provide a process for securely updating to a newly audited revision.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to install and run an MCP server directly from a GitHub reference via npx -y github:gpt-img-2/oxvodo-prompt-mcp without pinning a specific commit, tag, or package version. That creates a supply-chain risk: if the upstream repository is modified, hijacked, or force-updated, users may execute unintended code locally when following the documented setup.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

- Text-to-video: https://oxvodo.com/text-to-video
- Image-to-video: https://oxvodo.com/image-to-video
- Video-to-video: https://oxvodo.com/video-to-video
- Raw Skill: https://oxvodo.com/skills/oxvodo-motion-prompt-architect/SKILL.md
- MCP source: https://github.com/gpt-img-2/oxvodo-prompt-mcp
- ClawHub listing: https://clawhub.ai/gpt-img-2/skills/oxvodo-motion-prompt-architect

Static analysis

No suspicious patterns detected.