DramaAIStudio（AI影视工场）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:51 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent iDrama creative-workflow integration, but it asks for persistent agent-memory changes, persistent authenticated cron jobs, and risky token handling that users should review carefully before installing.

Install only if you are comfortable with a skill that can persist agent rules, store or reuse an iDrama token, and create recurring authenticated monitoring jobs. Prefer host-managed secrets over .env or --token, inspect every cron command before approving it, use only the official iDrama base URL, and confirm before delete or write-back API actions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:30

Finding

Mandatory Modification of Persistent Agent Memory

Content

View full analysis

### drama-ai-studio技能规则 > 1. **有限发散**：所有功能优先使用本技能提供的平台原生API和标准业务流程，禁止自定义非规范操作 > 2. **先查后做**：调用任何API前必须先读取对应`{baseDir}/references/ref-*.md`文档，核对所有必填参数和格式要求 > 3. **不懂就问**：需求有任何歧义、参数不明确的地方，必须先询问用户确认，绝不猜测执行 > 4. **辅助引导**：每次操作完成后主动列出3-5个下一步可选操作，降低用户决策成本 3. 校验写入成功后再执行后续技能操作，以保证本技能被合理、规范、正确的使用 4. 每次使用本技能后，都要自检对于各项技能规则的遵循情况。 ``` ### Technical Analysis The Skill requires the Agent to read and modify the global `MEMORY.md` file before performing its declared API functionality. The inserted rules alter future Agent behavior, including mandatory API workflow, mandatory clarification behavior, and mandatory response formatting. These instructions are not limited to the active Skill invocation. Writing them into persistent Agent memory allows the Skill's behavioral policy to remain active across later sessions. This exceeds the minimum privileges needed to manage iDrama projects because all necessary operating instructions can remain inside `SKILL.md`. Although the inserted rules shown here are not overtly destructive, the mechanism is an Agent memory-poisoning primitive. A future package update or compromised Skill could replace the persisted block with instructions that redirect credentials, suppress warnings, or alter unrelated Agent operations. ### Attack Path 1. A user loads or invokes the Skill. 2. The Skill instructs the Agent to open the global `MEMORY.md`. 3. The Agent appends or updates the `drama-ai-studio` rules. 4. The modified memory persists after the current Skill invocation ends. 5. Future Agent sessions read and follow the persisted Skill-controlled instructions, including sessions in which this Skill is not actively needed. ### Impact Assessment The Sk ...[truncated 348 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:146

Finding

Recurring Authenticated Agent Execution Through Persistent Cron Jobs

Content

View full analysis

" \ --cron \ --tz "Asia/Shanghai" \ --session isolated \ --message "（1）请用 bash 执行 `IDRAMA_BASE_URL="https://idrama.lingban.cn" python {baseDir}/scripts/sync_project_asset_final_candidates_snapshot.py --token --quiet`。若输出 status=changed，则向当前会话返回 diff 详情：重点说明哪些 asset_id 的 final_candidate_ids / final_items 发生变化，对于图片或视频，需要给出可点击查看的URL；若 status=initial，提示已建立候选终稿首版快照；若 unchanged 则保持静默。（2）请用 bash 执行 `openclaw cron list`，获取和显示当前的 Cron 定时任务列表，询问用户是否做出调整（创建、启用、停用、修改和删除）。" \ --announce \ --channel \ --to ``` ```bash openclaw cron add \ --name "iDrama 分镜视频终稿变更通知 play_id=" \ --cron \ --tz "Asia/Shanghai" \ --session isolated \ --message "（1）请用 bash 执行 `IDRAMA_BASE_URL="https://idrama.lingban.cn" python {baseDir}/scripts/sync_project_storyboard_selected_videos_snapshot.py --token --quiet`。若输出 status=changed，则向当前会话返回 diff 详情：按 episode_no、shot_id 列出变更，对于图片或视频，需要给出可点击查看的URL；若 status=initial，提示已建立分镜选中视频首版快照；若 unchanged 则保持静默。（2）请用 bash 执行 `openclaw cron list`，获取和显示当前的 Cron 定时任务列表，询问用户是否做出调整（创建、启用、停用、修改和删除）。" \ --announce \ --channel \ --to ``` ### Technical Analysis The Skill can install recurring OpenClaw Cron jobs that survive the current interaction. Each job starts an isolated Agent session, invokes a local Python script with an API credential, performs authenticated network requests, and sends results to a selected messaging channel. Scheduled monitoring is part of the declared feature set, so the network queries themselves are functionally relevant. Nevertheless, the implementation creates persistent authenticated execution and therefore requires stronge ...[truncated 1318 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync_project_asset_final_candidates_snapshot.py:77

Finding

Bearer Credential Disclosure Through an Unrestricted API Base URL

Content

View full analysis

Tuple[int, Dict[str, Any]]: url = urllib.parse.urljoin(base_url.rstrip("/") + "/", path.lstrip("/")) req = urllib.request.Request( url, method=method, headers={ "Authorization": f"Bearer {token}", "Accept": "application/json", }, ) ``` The destination is externally configurable: ```python parser.add_argument( "--base-url", default=os.environ.get("IDRAMA_BASE_URL", "https://idrama.lingban.cn"), help="API 基地址（默认读 IDRAMA_BASE_URL）", ) ``` The storyboard script implements the same behavior: ```python url = urllib.parse.urljoin(base_url.rstrip("/") + "/", path.lstrip("/")) req = urllib.request.Request( url, method=method, headers={ "Authorization": f"Bearer {token}", "Accept": "application/json", }, ) ``` ### Technical Analysis Both scripts accept an arbitrary base URL from either a command-line option or the `IDRAMA_BASE_URL` environment variable. They then attach the iDrama bearer token to requests sent to that destination without validating the URL scheme, hostname, or port. Consequently, anyone able to influence script arguments or the execution environment can redirect the authenticated request to a server they control. The server receives the full `Authorization` header before the expected API response validation occurs. The implementation also does not explicitly prevent cross-origin HTTP redirects from carrying sensitive authentication into an unintended request flow. ### At ...[truncated 972 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:165

Finding

API Token Exposed Through Command-Line Arguments and Scheduler Metadata

Content

View full analysis

--token --quiet ``` ```markdown python {baseDir}/scripts/sync_project_storyboard_selected_videos_snapshot.py --token --quiet ``` Both scripts explicitly support the command-line token: ```python parser.add_argument( "--token", default=os.environ.get("IDRAMA_TOKEN", ""), help="Bearer Token（默认读环境变量 IDRAMA_TOKEN）", ) ``` ### Technical Analysis Passing a secret through `--token` places the complete bearer token in the process argument vector. Depending on the host configuration, command-line arguments may be visible through process inspection utilities, scheduler job definitions, diagnostic tooling, crash reports, shell history, audit logs, or OpenClaw Cron metadata. The Skill already supports `IDRAMA_TOKEN` through the environment, so placing the token directly in the scheduled command is unnecessary. Environment variables are not universally secret either, but protected secret injection is materially safer than embedding credentials in a persistent job message and process command line. ### Attack Path 1. The Skill creates or runs a command containing `--token `. 2. The token becomes part of the process arguments and potentially the persistent Cron job definition. 3. A local user, monitoring agent, log collector, administrator, or exposed job-inspection interface reads the command. 4. The observer extracts the bearer token. 5. The token is replayed against the iDrama API until expiration or revocation. ### Impact Assessment The exposed token gr ...[truncated 348 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sync_project_asset_final_candidates_snapshot.py:363

Finding

Arbitrary File Write Through Unvalidated Project Identifier

Content

View full analysis

None: os.makedirs(os.path.dirname(path) or ".", exist_ok=True) with open(path, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) f.write("\n") ``` ### Technical Analysis The positional `play_id` value is directly incorporated into a filesystem path. No validation restricts it to the expected project-ID format, and the resolved path is not checked to ensure it remains beneath `data_dir`. A value containing parent-directory components can escape the intended project-data directory. On platforms where an absolute second path causes the preceding path to be discarded, an absolute `play_id` can also redirect the write to another location. The fixed JSON filename limits filename choice but does not prevent directory selection. The scripts create missing directories and overwrite existing snapshot files, increasing the practical effect of the path traversal. ### Attack Path 1. An attacker or untrusted caller controls the positional `play_id`. 2. The caller supplies a traversal or absolute path instead of a legitimate project ID. 3. `os.path.join` ...[truncated 908 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

应示例、错误处理等）位于 `{baseDir}/references/` 下，文件名形如 `ref-*.md`。占位符 `{baseDir}` 与本技能文件 `SKILL.md` 所在目录相同（二者同级，详见各小节文末引用路径）。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The explicit recommendation to write the API token into a .env file is credential persistence behavior that can facilitate credential access by any actor or tool with filesystem access. In the context of a skill package, this is more dangerous because the secret sits near scripts and documentation that may be broadly readable or backed up.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

### 2.3 其他获取方式

用户也可在 OpenClaw/宿主侧配置环境变量 IDRAMA_TOKEN，或在用户明确同意时将令牌写入技能目录下的 .env 以便后续会话与脚本复用。

---

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill manages host-level Cron jobs through openclaw cron commands, which exceeds the expected scope of a content-creation API wrapper. Granting a skill the ability to create, edit, run, and remove scheduled jobs enables persistent autonomous behavior on the host and can be abused for surveillance, unwanted repeated actions, or long-lived exfiltration workflows.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The scheduled task templates embed IDRAMA_TOKEN directly into command strings and then configure automated jobs to post project diffs back to chat. Embedding secrets in command lines is especially dangerous because process arguments and cron definitions are often visible to logs, job listings, shell history, or other local users, turning a normal API token into an easily recoverable credential.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 569)May include surrounding context.

md

1. **剧本集列表**：`GET /openapi/drama/{play_id}/scripts` 获取所有剧集及文件名、标题、上传时间。
2. **某集剧本内容**：`GET /openapi/drama/{play_id}/scripts/{episode_no}/content` 获取该集原文。
3. **删除某集剧本**：`DELETE /openapi/drama/{play_id}/scripts/{episode_no}` 删除指定集（需确认该集不再用于分析或已备份）。

### 10.3 查看剧目统计与风格配置（§4）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 594)May include surrounding context.

md

3. **查看镜头详情**：`GET /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}` 获取镜头信息、提示词、已绑定资产等。
4. **为镜头添加资产**：`POST /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}/add-asset` 绑定角色/场景/道具等（建议先用 §6 的资产列表/详情确认 `asset_id`）。
5. **生成和优化分镜提示词**：`POST /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}/optimize-prompt` 优化镜头提示词，并按需回写（`save=true`）。
6. **删除镜头（谨慎）**：若需移除镜头，`DELETE /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}`（建议先确认是否已关联生成任务或引用资源）。

### 10.6 分镜出图与视频：任务生成（§8）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 594)May include surrounding context.

md

3. **查看镜头详情**:`GET /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}` 获取镜头信息、提示词、已绑定资产等。
4. **为镜头添加资产**:`POST /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}/add-asset` 绑定角色/场景/道具等(建议先用 §6 的资产列表/详情确认 `asset_id`)。
5. **生成和优化分镜提示词**:`POST /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}/optimize-prompt` 优化镜头提示词,并按需回写(`save=true`)。
6. **删除镜头(谨慎)**:若需移除镜头,`DELETE /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}`(建议先确认是否已关联生成任务或引用资源)。

### 10.6 分镜出图与视频:任务生成(§8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

> **说明**：本文为《drama-ai-studio》技能中单个 HTTP 接口的完整说明。

### 5.4 DELETE /openapi/drama/{play_id}/scripts/{episode_no}

删除指定集剧本。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/ref-5-4-delete-openapi-drama-play-id-scripts-episode-no.md (reported line 3)May include surrounding context.

md

> **说明**：本文为《drama-ai-studio》技能中单个 HTTP 接口的完整说明。

### 5.4 DELETE /openapi/drama/{play_id}/scripts/{episode_no}

删除指定集剧本。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 441)May include surrounding context.

md

> **说明**：本文为《drama-ai-studio》技能中单个 HTTP 接口的完整说明。

### 7.6 DELETE /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}

删除指定镜头。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/ref-7-6-delete-openapi-drama-play-id-storyboard-episode-no-shots-shot-id.md (reported line 3)May include surrounding context.

md

> **说明**：本文为《drama-ai-studio》技能中单个 HTTP 接口的完整说明。

### 7.6 DELETE /openapi/drama/{play_id}/storyboard/{episode_no}/shots/{shot_id}

删除指定镜头。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill requires environment access, local file reads/writes, and network use but declares no explicit tool scope or allowed-tools boundaries. That weakens least-privilege controls and makes it easier for the agent to use broader host capabilities than users would reasonably expect from a creative-platform integration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill mandates reading and writing local files such as MEMORY.md and session_state.json as part of normal operation, even though these are not required for the platform's core HTTP APIs. This creates unnecessary stateful side effects, increases data leakage risk, and allows cross-session contamination through local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requires silent modification of local files like MEMORY.md and session_state.json without a clear user-facing data write notice at the point of action. Hidden persistence reduces user awareness and can cause unexpected retention of project context or behavioral rules across sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to use bash/subprocess execution even though the advertised core function is calling HTTP APIs for drama creation. Introducing shell execution expands the attack surface to arbitrary command execution paths, tool misuse, and unintended host interaction beyond the platform API boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to persist the user's API token in a local .env file for reuse across sessions and scripts. Persisting credentials locally broadens exposure from a transient session secret to a reusable filesystem secret that may be read by other tools, sessions, or users on the host.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill tells the agent to obtain the user's API token from chat, environment variables, or local files, then reuse it across sessions and scheduled jobs. This materially increases secret handling risk because the token becomes accessible to more execution contexts and may be exposed through logs, prompts, or file reads.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to help search for and download images from the network for later upload, which goes beyond the declared platform integration behavior. This broadens network access and introduces risks around untrusted content retrieval, copyright/privacy issues, and fetching attacker-controlled payloads or tracking URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file describes a DELETE endpoint that removes a script episode, but it provides no warning about the destructive nature of the action or its impact on user data. Under the markdown-specific warning criteria, documentation for behaviors affecting data integrity should disclose deletion risk or irreversibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file documents candidate_image_urls as directly retrievable signed original-image URLs, but it does not warn users that these links may grant temporary access to original asset content and should be handled carefully. Because the file is markdown and describes behavior affecting user data/privacy, the omission of any caution about sharing or exposing signed URLs qualifies as a missing user warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file describes that generated images will be written as new candidate images for an asset and persisted by a background worker. Because markdown files should warn about behaviors affecting user data or system state, the description should explicitly disclose that invoking this endpoint creates and stores new files in project assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents that the response returns user_id, username, and resolved_by, which are user-identifying fields, but it provides no warning about privacy, access sensitivity, or appropriate handling of this data. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown describes that the endpoint returns prompt, description, original_script, and original_content, which may contain user-authored creative content or internal asset names. The document does not include any warning about sensitivity, privacy, or handling of returned content, even though this behavior could affect user data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API documentation states that the save parameter defaults to true, meaning a prompt-optimization request will modify persistent shot data unless callers explicitly opt out. In a creative workflow skill that may be driven by an agent or automation, this creates a dangerous side effect: a user may intend to preview or test optimization but instead silently overwrite storyboard prompt content, causing integrity loss, unintended edits, or workflow disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents an endpoint that deletes a specified shot, which is a destructive and potentially irreversible action. The description only states '删除指定镜头' and provides no warning about deletion impact, recoverability, or need for user confirmation.

Content

No source excerpt is available for this finding.