ClawHub
Back to skill

Security audit

jimeng-openclaw-video

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent video-generation purpose, but it handles credentials and local side effects too broadly for normal installation without review.

Install only after reviewing the code or isolating it. Use a dedicated Wanjiedata/Jimeng API key, avoid sensitive prompts, remove shipped log/result files, disable or gate automatic URL opening, and install dependencies through a controlled pinned environment instead of allowing runtime pip installation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
model/scripts/jimeng_worker.py:41
Finding

Arbitrary OpenClaw Provider Credential Is Transmitted to an External Service

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
model/scripts/video_interface.py:7
Finding

Unpinned Dependency Is Installed Automatically at Runtime

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
model/scripts/jimeng_worker.py:16
Finding

User Prompts, Task Identifiers, and Signed Media URLs Are Persisted in Plaintext

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
model/scripts/jimeng_worker.py:31
Finding

Remote Service Response Is Opened Through Operating-System URL Handlers Without Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (23)

Tainted flow: 'url' from requests.post (line 85, network input) → subprocess.Popen (code execution)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

A URL derived from an external API response is sent directly into subprocess.Popen(['open', url]). While not a shell injection, this is still a dangerous untrusted-to-execution boundary because the OS may dispatch arbitrary URI schemes to local handlers, potentially launching applications or triggering privileged workflows. In an agent skill, remote-controlled opening of local handlers is a serious execution-adjacent risk.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 35)May include surrounding context.

python
if system == 'Windows':
            os.startfile(url)
        elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:

Tainted flow: 'url' from requests.post (line 85, network input) → subprocess.Popen (code execution)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

A remotely supplied URL is passed to subprocess.Popen(['xdg-open', url]), allowing external data to influence system-level handler execution. This can open browsers, local apps, or custom protocol handlers depending on system configuration, making it a credible path to phishing, unsafe file access, or local application invocation. Because the skill performs this automatically after a network response, the exposure is significant.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 37)May include surrounding context.

python
elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:
        log_exc("[!] 打开URL失败", e)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

bash
# 手动清理锁文件
rm model/scripts/jimeng.lock

提交失败

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README states '输入一段中文描述' for generating video, which presents Chinese as a required interaction language rather than a user choice. This is a natural-language locale policy concern because the skill appears to force a specific language without documenting opt-in or a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user-facing documentation in this file is written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill launches the system browser or URL handler automatically for a remote URL with no user confirmation. This creates an unsafe side effect on the host, allowing remote content to drive local application behavior or browser navigation. In a skill environment, silent launching of external URLs is more dangerous because users may not expect local execution-like actions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script takes a URL returned from a remote API and passes it directly to the operating system URL handler via open on macOS. Even without shell=True, invoking the default handler on attacker-controlled or compromised-service-controlled URLs can trigger local application handlers or dangerous URI schemes, causing unintended application execution or phishing flows. In this skill context, automatically opening remote content makes the issue more dangerous because the action happens without user confirmation.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 35)May include surrounding context.

python
if system == 'Windows':
            os.startfile(url)
        elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The Linux path uses xdg-open on a URL obtained from a remote API response. This can invoke the system's registered handlers for arbitrary URI schemes or files, enabling attacker-influenced application launching or redirection to unsafe resources. The risk is elevated here because the URL is not validated and is opened automatically after receipt from the external service.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 37)May include surrounding context.

python
elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:
        log_exc("[!] 打开URL失败", e)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill reads an API key from a user configuration file under the home directory. Although it appears to use the key for the intended external API call, accessing user credentials from local config expands the skill's trust boundary and could expose secrets through logs, crashes, or future code changes. The lack of explicit disclosure or scoped secret handling makes this a real credential-access concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The user-provided prompt is transmitted to an external API, and there is no indication in the script of user-facing disclosure or consent. Prompts can contain sensitive business, personal, or credential data, so sending them to a third party without warning is a privacy and data-handling risk. In this context, the skill's purpose may require external generation, but the missing disclosure still makes it unsafe.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The script sends the prompt and authorization header to an external service endpoint. External transmission is part of the apparent feature, so this is not inherently malicious, but it is still a real data exposure boundary because user content and credentials leave the local environment. The danger is increased by the absence of disclosure, consent, and response validation safeguards.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 65)May include surrounding context.

python
# 1. 提交任务
        payload = {"req_key": model, "prompt": prompt}
        log(f"提交任务到: {SUBMIT_URL}")
        resp = requests.post(SUBMIT_URL, headers=headers, json=payload, timeout=30)
        data = resp.json()
        
        task_id = data.get("data", {}).get("task_id")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 78)May include surrounding context.

python
# 2. 轮询
        for i in range(15):  # 5分钟 / 20秒 = 15次
            time.sleep(20)   # 每20秒查一次
            res_resp = requests.post(GET_URL, headers=headers, json={"req_key": model, "task_id": task_id}, timeout=30)
            res_data = res_resp.json()
            
            status = res_data.get("data", {}).get("status")

Tainted flow: 'task_id' from requests.post (line 68, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 78)May include surrounding context.

python
# 2. 轮询
        for i in range(15):  # 5分钟 / 20秒 = 15次
            time.sleep(20)   # 每20秒查一次
            res_resp = requests.post(GET_URL, headers=headers, json={"req_key": model, "task_id": task_id}, timeout=30)
            res_data = res_resp.json()
            
            status = res_data.get("data", {}).get("status")

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill both alters the environment by installing packages and launches a separate detached worker process, despite limited justification in the visible code. This combination expands attack surface, reduces transparency through hidden background execution, and makes abuse or unintended behavior harder for a user or operator to notice and control.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

The code automatically invokes pip at runtime to install a dependency without user consent or integrity controls. This modifies the execution environment and can expose users to supply-chain risk, unexpected network access, and execution of package install hooks if package resolution is compromised.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 10)May include surrounding context.

python
try:
        importlib.import_module("requests")
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_jimeng_generation(prompt, model="jimeng_t2v_v30"):
    ensure_dependencies()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Automatic pip installation without warning or confirmation is a real security issue because it silently performs networked code acquisition and environment changes on behalf of the user. In a skill context, this is more dangerous because users typically expect a bounded capability, not implicit package management side effects.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 24)May include surrounding context.

python
if platform.system() == 'Windows':
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, start_new_session=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 27)May include surrounding context.

python
subprocess.Popen(cmd, stdout=devnull, stderr=devnull, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, start_new_session=True)
        
    return f"[*] 即梦生成任务已提交: {prompt}，请在聊天窗口耐心等待结果通知。"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly states that generation results are written to a local file (veo_result.txt) but does not warn the user that invoking the skill modifies the local filesystem. This is a transparency and consent issue: users may run the skill expecting a pure API call while it creates or overwrites artifacts locally, which can cause unintended data exposure, clutter, or conflicts in shared environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This plain-text log file contains only Chinese natural-language status messages and does not indicate any user opt-in, language selection, or justified region-specific constraint. Under the policy rule, forcing a specific language without choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

Multiple user-visible messages such as task status and error logs are emitted only in Chinese. This imposes a specific language on users without opt-in or locale selection, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script reads an API key from local configuration without any explicit notice to the user. This is a weaker issue than direct exfiltration, but it still represents undisclosed access to local secrets and can violate user expectations or security policy. The code does not appear to expose the key directly, so the impact is limited but real.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The returned status message is hardcoded in Chinese, which imposes a specific language on the user without any visible language choice or opt-in. This can violate language or locale policy when the skill is intended for general use rather than a clearly documented Chinese-only context.

Content

No source excerpt is available for this finding.