Security audit

jiege-openclaw-video

Security checks for vulnerabilities and agentic risk

Overview

This video skill appears to do what it claims, but it should be reviewed because it starts background jobs, uses a local API key for a third-party service, and automatically opens returned links.

Install only if you are comfortable with a local background Python process sending your prompt and an API key from your OpenClaw config to a third-party service, then automatically opening a returned link. Prefer using a dedicated low-privilege API key, avoid sensitive prompts, and consider disabling or reviewing the auto-open behavior before use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: if platform.system() == 'Windows': os.startfile(url) elif platform.system() == 'Darwin': # macOS subprocess.Popen(['open', url]) else: # Linux subprocess.Popen(['xdg-open', url])
Confidence: 88% confidence
Finding: The code launches a URL using the local OS handler via subprocess without validating the scheme, domain, or provenance of the URL. Although it avoids shell injection by using an argument list, it still permits remote content to trigger local browser/application launches, which can expose users to phishing pages or unsafe protocol handlers.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: elif platform.system() == 'Darwin': # macOS subprocess.Popen(['open', url]) else: # Linux subprocess.Popen(['xdg-open', url]) def generate_video(prompt, model, seconds): print(f"[*] 调试：检查锁文件路径 {LOCK}", flush=True)
Confidence: 88% confidence
Finding: On Linux, the script passes a remotely derived URL to xdg-open, which can invoke the default application for the supplied URI. This creates a trust boundary violation because untrusted model output can cause local application/browser launches without user review.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill launches a local Python subprocess based on a user message and detaches it, which creates an execution boundary outside the host runtime with reduced visibility and control. Although `spawn` is used with argument separation rather than shell interpolation, the background process can still consume resources, invoke further actions, or perform unsafe behavior inside `veo_worker.py`, making this a genuine security concern in an agent skill.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The helper function is explicitly designed to open arbitrary URLs in the user's default application, and later the URL comes from remote model output. In this skill context, that makes the capability more dangerous because the code grants an external service the ability to trigger local navigation or application handling with no user consent.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The script reads an API key from a sensitive configuration file in the user's home directory without any explicit permission flow or clear justification in the skill interface. Accessing local secrets broadens the blast radius of the skill and creates risk if the script behavior is modified, reused, or combined with additional exfiltration paths.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The README claims the skill can be triggered via broad natural-language interaction without clearly constraining what phrases activate it. In an agent platform, overly generic trigger descriptions can cause unintended invocation, especially for a skill that performs remote actions and launches follow-on behavior automatically.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README states that after generation the system will automatically open a webpage in the default browser, but it does not warn users that the skill will cause a system-affecting action. Automatic browser launch can surprise users, create phishing or drive-by navigation risk if links are not strictly validated, and expands the impact of any compromise in the remote workflow.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README describes integration with a remote Veo-based video generation workflow and later instructs users to configure an API key, but it does not warn that prompts, outputs, and credentials are involved in a third-party service flow. This can lead users to unknowingly send sensitive content off-device or mishandle API credentials without understanding the privacy and security implications.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase is described as a very broad natural-language pattern ('生成视频：[...]') with no boundary conditions, confirmation step, or scope restrictions. In an agent environment, overly broad triggers can cause unintended activation from ordinary conversation, leading to unwanted backend actions and possible consumption of API-backed resources.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill states that it will automatically open a browser page when the task completes, but does not clearly warn users before installation or use that it will modify the local user environment. Unexpected browser launching is a side effect that can disrupt workflows, expose generated content on screen, and in some contexts increase phishing or unsafe navigation risk if the opened page is not tightly controlled.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The installation instructions require the user to place an API key in a local configuration file, but the documentation gives no notice about how that credential will be used, what service receives prompts, or what privacy implications apply. This can lead users to expose sensitive prompts or rely on a third-party service without informed consent about credential handling and data transmission.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill silently starts a detached background subprocess from a simple text trigger without informing the user beforehand or obtaining consent for local process execution. In an agent environment, hidden background execution reduces transparency and can surprise users with resource usage or downstream actions, especially given the message implies later browser interaction.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script reads a local API key and transmits user-supplied prompt content to a third-party remote API, but provides only debug prints rather than meaningful consent or disclosure. This is dangerous because prompts may contain sensitive data, and the user may not realize their content and authentication context are being sent off-host.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script extracts the first URL from streamed remote model output and immediately opens it locally without confirmation. This is particularly risky because model output is untrusted and could direct the user to phishing, malware delivery, or unsafe custom URI handlers, making the skill context materially more dangerous.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The function launches a background worker immediately and detaches it from the caller without any confirmation, visibility, or control surface for the user. In an agent context, this can surprise users, consume local resources, and make abuse harder to notice or stop, especially if prompts are attacker-influenced or repeatedly triggered.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: hooks.js:11