ClawHub
Back to skill

Security audit

SeeVido Video Prompt Architect

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent video-prompting workflow, but its optional setup tells users to run an unpinned GitHub MCP server through npx, which creates a material review concern.

The core prompt-writing skill is reasonable to use manually. Treat the optional MCP setup as review-worthy: only install it after checking the GitHub source and preferably pinning a reviewed commit or version, and run it with limited access to local files, credentials, and environment variables.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Execution of Unpinned Remote Code Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–73
Vulnerability Type: Unpinned retrieval and execution of code from a third-party GitHub repository
Risk Level: High

Vulnerable Code

bash
openclaw mcp add seevido \
  --command npx \
  --arg -y \
  --arg github:gpt-img-2/seevido-prompt-mcp \
  --include 'build_video_prompt,plan_reference_sequence,diagnose_video_prompt,get_seevido_resources'
bash
npx -y github:gpt-img-2/seevido-prompt-mcp

Technical Analysis

The Skill directs users to retrieve and execute an MCP package directly from github:gpt-img-2/seevido-prompt-mcp. The repository reference is not pinned to an immutable commit hash or an integrity-verified release artifact. Consequently, the code executed by users can change after the Skill has been reviewed.

The npx -y option suppresses the normal installation confirmation, reducing the opportunity for users to inspect the package source or notice an unexpected dependency change. Depending on the package configuration, executable code may run through package lifecycle scripts or when the MCP server starts.

This is best classified as remote payload retrieval and execution because the effective executable payload resides outside the audited project and remains mutable.

Attack Path

  1. An attacker compromises the referenced GitHub repository, its maintainer account, or another mechanism controlling its default branch.
  2. The attacker modifies the MCP package or one of its dependencies to include malicious lifecycle or runtime code.
  3. A user follows the installation instructions in SKILL.md.
  4. npx -y downloads the repository's current, potentially modified contents without an interactive confirmation.
  5. The malicious code executes under the account and environment used to launch OpenClaw or npx.
  6. The code can access resources available to that process, subject to operating-system permissions and any applicable sandboxing.

Impact Assessme

...[truncated 592 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the GitHub dependency to a reviewed, immutable full commit hash rather than the repository's mutable default branch.
  2. Prefer a signed and versioned release artifact with a published cryptographic checksum or package-manager integrity metadata.
  3. Remove -y so users must explicitly approve installation after reviewing the resolved source and version.
  4. Audit the package's source, transitive dependencies, lifecycle scripts, and MCP startup behavior before recommending execution.
  5. Document the expected commit hash and provide checksum or signature verification steps.
  6. Run the MCP server with least privilege in an isolated environment that has restricted filesystem, credential, and network access.
  7. Establish a controlled update process in which new commits or releases are reviewed before the pinned reference is changed.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs users to install and execute an MCP server directly from a GitHub reference via npx -y github:gpt-img-2/seevido-prompt-mcp without pinning to a specific commit, tag, or verified package version. This creates a software supply chain risk: if the upstream repository is changed, compromised, renamed, or its dependency tree becomes malicious, users may execute attacker-controlled code on their local machine when following the setup instructions.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
- Wan: https://seevido.org/models/wan
- Prompt library: https://seevido.org/seedance-2-0-prompts
- Video-to-prompt tool: https://seevido.org/video-to-seedance-prompt
- Raw Skill: https://seevido.org/skills/seevido-video-prompt-architect/SKILL.md
- MCP source: https://github.com/gpt-img-2/seevido-prompt-mcp
- ClawHub listing: https://clawhub.ai/gpt-img-2/skills/seevido-video-prompt-architect

Static analysis

No suspicious patterns detected.