ClawHub
Back to skill

Security audit

jimeng-openclaw-video

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to generate videos as advertised, but it uses local credentials and broad system actions that users should review before installing.

Install only if you are comfortable with this skill reading your OpenClaw API-key config, sending prompts to the Wanjie/Jimeng service, running a detached Python worker, installing requests if absent, writing prompts/results to plaintext local files, and automatically opening returned video links. Review or modify the code first if you need explicit credential selection, pinned dependencies, no automatic URL opening, or tighter logging controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if system == 'Windows':
            os.startfile(url)
        elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:
Confidence
96% confidence
Finding
The code launches a URL returned by a remote API via the platform URL opener on macOS. Although it does not invoke a shell directly, it still hands attacker-controlled data to a trusted OS handler, which can open dangerous URI schemes such as file://, custom app protocols, or other handler-triggering links. In an agent skill context, automatically opening remote-supplied URLs increases the risk because the action happens without an explicit user confirmation step.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:
        log_exc("[!] 打开URL失败", e)
Confidence
96% confidence
Finding
The Linux path uses xdg-open on a URL fully controlled by remote response data. xdg-open can dispatch the target to a browser or another registered application, so untrusted schemes or crafted links may trigger unintended local application behavior or opening of local resources. In this skill, that behavior is especially risky because the URL is derived from an external API response and is opened automatically after generation.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
        importlib.import_module("requests")
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_jimeng_generation(prompt, model="jimeng_t2v_v30"):
    ensure_dependencies()
Confidence
90% confidence
Finding
The code automatically installs a Python package at runtime via pip when `requests` is missing. Runtime dependency installation is risky because it executes external package management operations in the current environment, can unexpectedly modify the host, and may pull unpinned code from package indexes without explicit user consent. In a skill context, this is more dangerous because the skill has no metadata or stated trust boundary justifying self-modifying behavior.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if platform.system() == 'Windows':
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, start_new_session=True)
Confidence
83% confidence
Finding
This spawns a detached background subprocess and suppresses all stdout/stderr, which reduces visibility and control over what the worker does after launch. Even though `shell=False` avoids direct shell injection here, detached execution can be abused to run persistent or hidden actions, and the lack of logging makes auditing and incident response harder. The risk is elevated because the worker script is launched from the skill directory with no stated operational justification or monitoring.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.Popen(cmd, stdout=devnull, stderr=devnull, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, start_new_session=True)
        
    return f"[*] 即梦生成任务已提交: {prompt}，请在聊天窗口耐心等待结果通知。"
Confidence
83% confidence
Finding
On non-Windows systems, the code similarly launches a new session in the background while discarding output, creating an opaque detached process. This pattern hinders supervision, may outlive the parent application, and can conceal unintended or malicious behavior inside `jimeng_worker.py`. In the context of an agent skill, hidden long-running workers are more concerning because users may not expect autonomous background execution.

Tainted flow: 'url' from requests.post (line 85, network input) → subprocess.Popen (code execution)

Critical
Category
Data Flow
Content
if system == 'Windows':
            os.startfile(url)
        elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:
Confidence
99% confidence
Finding
This is a true vulnerability: data from a remote HTTP response is used as the argument to open a URL through an OS-level handler. Even without shell injection, this enables externally controlled triggering of local protocol handlers, browser actions, or file-opening behavior, which can be abused for phishing, local file access attempts, or invoking sensitive custom URI handlers. The skill context makes this more dangerous because the remote endpoint is trusted implicitly and the action is performed automatically.

Tainted flow: 'url' from requests.post (line 85, network input) → subprocess.Popen (code execution)

Critical
Category
Data Flow
Content
elif system == 'Darwin':
            subprocess.Popen(['open', url])
        else:
            subprocess.Popen(['xdg-open', url])
    except Exception as e:
        log_exc("[!] 打开URL失败", e)
Confidence
99% confidence
Finding
This Linux variant has the same core issue: untrusted network data reaches an external application invocation sink. xdg-open may route the string to browsers or registered desktop handlers, so a malicious or compromised API response can cause unsafe navigation or trigger local applications via custom schemes. Because this worker is designed to run unattended after receiving remote results, the exploit path is practical and should be treated seriously.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This file both installs dependencies at runtime and launches a detached worker process, a combination that gives the skill the ability to modify its environment and execute additional code out of band. Those capabilities materially expand the attack surface and can enable unauthorized code execution, persistence, or evasion of normal supervision, especially since no metadata or clear purpose is provided to justify them. The missing context makes this behavior more suspicious, not less.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The worker silently reads an API key from a local config file and transmits user prompt content to an external third-party service with only internal logging. While sending prompts to a remote model/video service may be intended, the lack of explicit user-facing disclosure or consent is a real privacy and secret-handling concern in an agent environment, especially if prompts can contain sensitive user data. The danger is contextual rather than exploit-style code execution, but it is still a meaningful security issue.

Static analysis

No suspicious patterns detected.