ClawHub
Back to skill

Security audit

uni-vision-engine

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill is mostly aligned with its stated purpose, but it embeds a reusable session token, installs an npm package during normal use, and gives broad automatic image-handling instructions.

Review before installing. Do not use this skill as-is with real accounts or private images: remove and rotate the embedded session token, require credentials from a protected source, replace runtime npm installation with pinned packaged dependencies, and require explicit user confirmation before saving or sending each chat image to the Jimeng service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate.js:15
Finding

Hard-Coded Authentication Session Token

Content
View full analysis

Vulnerability Details

File Location: scripts/generate.js, line 15
Vulnerability Type: Hard-coded credential
Risk Level: High

Vulnerable Code

javascript
let sessionToken = "b79fcda2d907241e773cb52960b39978"; // Default cached authentication session

The embedded value is subsequently used as the bearer credential for the local video-generation API:

javascript
headers: {
  'Authorization': 'Bearer ' + sessionToken,
  ...form.getHeaders()
}

Technical Analysis

The source code contains a reusable authentication session token as its default configuration. The script uses this value unless the caller supplies a replacement through --session.

Source packages are not appropriate secret-storage mechanisms. Anyone able to download the skill, inspect a deployed copy, access source archives, or read logs containing the source can recover the credential. The fact that the audited request targets localhost does not protect the credential itself: it is still passed to the local API as authorization material and may represent a session for the underlying Jimeng service.

The audit cannot establish whether the exposed token is still active or what account it belongs to. Nevertheless, committing a token creates a concrete credential-disclosure vulnerability and should be treated as exposure.

Attack Path

  1. An attacker obtains or downloads a copy of the skill package.
  2. The attacker inspects scripts/generate.js and extracts the default session token.
  3. The attacker submits the token to a compatible local or underlying API implementation.
  4. If the session remains valid, the API accepts requests under the associated account.
  5. The attacker consumes available generation credits or performs other operations authorized for that session.

Impact Assessment

Successful exploitation is limited to the permissions granted to the exposed session. Based on the documented behavio ...[truncated 511 chars]

Remediation
View remediation

Remediation Suggestions

  1. Immediately revoke and rotate the exposed session token.
  2. Remove the default credential from the source code and all package or repository history where feasible.
  3. Require authentication material to be supplied through a protected environment variable, operating-system credential store, or dedicated secret manager.
  4. Fail securely when no credential is configured instead of falling back to an embedded value.
  5. Avoid exposing credentials in command-line arguments where other local users may inspect process listings. Prefer a protected environment variable or file descriptor.
  6. Add automated secret scanning to source-control and release pipelines.
  7. Apply least privilege, short expiration periods, rotation, and usage limits to service credentials.
  8. A safer pattern would be:
javascript
const sessionToken = process.env.JIMENG_SESSION_TOKEN;

if (!sessionToken) {
  console.error("JIMENG_SESSION_TOKEN is required.");
  process.exit(1);
}

T08 · Insecure Dependencies

Warning
Location
scripts/generate.js:4
Finding

Unpinned Dependency Installation During Runtime

Content
View full analysis

Vulnerability Details

File Location: scripts/generate.js, lines 4-9
Vulnerability Type: Unsafe runtime dependency acquisition
Risk Level: Medium

Vulnerable Code

javascript
try {
  require.resolve('form-data');
} catch(e) {
  console.log("Installing form-data wrapper dynamically...");
  const { execSync } = require('child_process');
  execSync('npm install form-data --no-save', { stdio: 'ignore' });
}

Technical Analysis

If form-data is unavailable, the script invokes npm during normal execution and installs an unspecified version from the configured package registry. The project contains no audited lockfile or integrity pin for this dependency.

As a result, the code actually executed can change after the skill has been reviewed. The selected package version depends on registry state and local npm configuration at execution time. npm installation can also execute package lifecycle scripts with the privileges of the user running the agent.

This is a supply-chain weakness rather than evidence that the current form-data package is malicious. Exploitation requires compromise or manipulation of the dependency-resolution path, such as a compromised registry account, a malicious configured registry, poisoned package metadata, or another source capable of controlling the package returned by npm.

Attack Path

  1. The skill runs in an environment where form-data cannot be resolved.
  2. An attacker compromises the relevant package publication channel or causes npm to use an attacker-controlled registry or package source.
  3. The script executes npm install form-data --no-save without an exact version or verified lockfile.
  4. npm retrieves the attacker-controlled package content.
  5. Malicious lifecycle code may execute during installation, or malicious module code executes when the subsequent require('form-data') loads it.
  6. That code runs with the filesystem, network, and proce ...[truncated 632 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove runtime execution of npm install.
  2. Declare form-data in package.json using an intentionally reviewed version.
  3. Generate and commit a lockfile that records resolved versions and integrity hashes.
  4. Install dependencies in a controlled build or deployment phase using npm ci.
  5. Configure an approved registry and protect npm configuration from untrusted modification.
  6. Audit dependency provenance and vulnerability status before release.
  7. Consider disabling lifecycle scripts during installation with --ignore-scripts when they are not required.
  8. Make startup fail with a clear error if a required preinstalled dependency is missing, rather than modifying the environment dynamically.
  9. Execute the skill under a least-privileged account with restricted filesystem and network access to reduce supply-chain compromise impact.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose broadly describes a local video-generation skill supporting both text-to-video and image-to-video, with native chat image interception and no UI. The supplied code does perform local API-based video generation against localhost, which is directionally aligned. However, there are material mismatches: the script enforces image input and exits if none is provided, so the claimed text-to-video capability is not actually implemented in this chunk. It also does not show any native chat/OpenClaw interception behavior; instead it only reads a local file path from a CLI argument. Additionally, it includes undeclared sensitive/auth behavior via a cached hardcoded bearer session token and undeclared package installation behavior using child_process. These are substantive enough to flag a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill describes extracting image payloads from chat context and saving them as local temporary files, then submitting them to a Docker-backed generation service, without a clear disclosure to the user about this handling. This creates a privacy and data-governance risk because sensitive user images may be copied, retained temporarily, and transmitted to another service without transparent notice or consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to automatically intercept user-sent images whenever it infers the user intends animation, but the trigger condition is broad and subjective. In an agentic environment, this can cause collection and processing of images without clear, explicit, per-action consent, especially for innocuous chat uploads that were not meant for external processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script installs an npm package at runtime with execSync('npm install form-data --no-save'), causing execution of external package manager logic during normal operation. This introduces supply-chain risk, non-deterministic behavior, and possible execution of malicious install scripts if the package, registry path, or environment is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

A hardcoded bearer session token is embedded directly in the script and used for authorization to the local API service. Anyone with access to the skill files can recover and reuse the token, potentially making unauthorized API requests, consuming paid credits, or accessing another user's authenticated session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

A natural-language default prompt is hardcoded in Chinese, which imposes a specific language choice on users by default. The file does not indicate that the language is optional, configurable by locale, or justified as region-specific behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/generate.js:9