ClawHub
Back to skill

Security audit

jimeng-openclaw-video

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill appears functional, but it needs review because it can send an overly broad local API credential to an external service and changes the runtime environment automatically.

Review before installing. Use only a dedicated Wanjiedata/OpenClaw credential with limited quota, avoid putting sensitive or confidential text in prompts, expect prompts and video URLs to be written to local logs, and do not run it in an environment where automatic pip installs or detached background workers are unacceptable.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
model/scripts/jimeng_worker.py:32
Finding

Unscoped OpenClaw Provider Credential Retrieval and External Disclosure

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
model/scripts/video_interface.py:6
Finding

Automatic Installation of an Unpinned Runtime Dependency

Content
View full analysis
Remediation
View remediation
--hash=sha256: ``` 4. Lock and verify transitive dependencies as well as the direct dependency. 5. Use an approved HTTPS package repository and prevent untrusted environment variables or user-level pip configuration from silently changing the index. 6. Run installation and Skill execution in an isolated virtual environment with minimum filesystem and network privileges. 7. If the dependency is absent at runtime, fail with a clear setup error instead of modifying the environment automatically. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
model/scripts/jimeng_worker.py:7
Finding

Sensitive Prompts and API Response Data Persisted in Plaintext Logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (19)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

bash
# 手动清理锁文件
rm model/scripts/jimeng.lock

提交失败

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README says users should input a Chinese description to generate videos, which reads as a language constraint. Because the document does not offer language choice or explain that the model is intentionally limited to Chinese for a documented regional or product reason, this may violate the language/locale policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The code automatically opens an external URL on the local Windows system using os.startfile, causing an unprompted client-side side effect. In a skill environment this is risky because remote service output controls the URL, which can trigger browser navigation or other registered handlers without user review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script reads an API key from the user's local ~/.openclaw/openclaw.json credential store without any explicit disclosure, consent flow, or scope restriction. In an agent skill context, silent access to unrelated stored credentials is dangerous because it expands trust boundaries and enables unauthorized use of secrets for external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script consumes a locally stored API key with no user-facing notice that a credential will be accessed and used. Hidden credential use in a skill is security-relevant because users may not expect this component to inherit or spend secrets from a shared config file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The user-supplied prompt is transmitted to a third-party external API without any warning or consent mechanism. Prompts can contain sensitive business data, personal information, or proprietary text, so undisclosed transmission to an external service creates a confidentiality risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This is a direct external transmission of user-controlled prompt data plus authorization headers to a remote service. While likely part of intended functionality, it is still a genuine security concern in a skill setting because it exports potentially sensitive input off-host and relies on a third-party endpoint using locally sourced credentials.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 60)May include surrounding context.

python
# 1. 提交任务
        payload = {"req_key": model, "prompt": prompt}
        log(f"提交任务到: {SUBMIT_URL}")
        resp = requests.post(SUBMIT_URL, headers=headers, json=payload, timeout=30)
        data = resp.json()
        
        task_id = data.get("data", {}).get("task_id")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 73)May include surrounding context.

python
# 2. 轮询
        for i in range(15):  # 5分钟 / 20秒 = 15次
            time.sleep(20)   # 每20秒查一次
            res_resp = requests.post(GET_URL, headers=headers, json={"req_key": model, "task_id": task_id}, timeout=30)
            res_data = res_resp.json()
            
            status = res_data.get("data", {}).get("status")

Tainted flow: 'task_id' from requests.post (line 63, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · model/scripts/jimeng_worker.py (reported line 73)May include surrounding context.

python
# 2. 轮询
        for i in range(15):  # 5分钟 / 20秒 = 15次
            time.sleep(20)   # 每20秒查一次
            res_resp = requests.post(GET_URL, headers=headers, json={"req_key": model, "task_id": task_id}, timeout=30)
            res_data = res_resp.json()
            
            status = res_data.get("data", {}).get("status")

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The combination of runtime dependency installation and detached subprocess spawning gives the skill the ability to modify the environment and execute code in the background without clear justification or transparency. In an agent skill, this increases operational risk because it expands execution capability beyond a simple interface wrapper and makes behavior harder to inspect.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The code automatically installs a Python package at runtime via pip if it is missing, without user consent, version pinning, or integrity verification. This creates a supply-chain and unexpected code-execution risk because package installation runs arbitrary setup/build logic from external sources and changes the host environment.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 10)May include surrounding context.

python
try:
        importlib.import_module("requests")
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_jimeng_generation(prompt, model="jimeng_t2v_v30"):
    ensure_dependencies()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Automatically invoking pip without warning or confirmation is a real security concern because it alters the system state and may fetch and execute untrusted package code from repositories or configured indexes. Users and operators are not given a chance to assess trust, network use, or compatibility before the action occurs.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
83% confidence
Finding

This launches a detached background subprocess with stdout and stderr suppressed, reducing visibility into what the spawned worker is doing and making monitoring or user control difficult. Although it avoids shell injection by passing an argument list, the detached and silent execution pattern can conceal unintended or unsafe behavior in the worker process.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 24)May include surrounding context.

python
if platform.system() == 'Windows':
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, start_new_session=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
83% confidence
Finding

On non-Windows platforms, the code starts the worker in a new session with stdout and stderr redirected to null, again creating an opaque background process. This is risky because it hides failures and can permit persistent execution outside the user's immediate awareness, especially when combined with user-controlled input passed to another script.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 27)May include surrounding context.

python
subprocess.Popen(cmd, stdout=devnull, stderr=devnull, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, start_new_session=True)
        
    return f"[*] 即梦生成任务已提交: {prompt}，请在聊天窗口耐心等待结果通知。"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README states that Windows will automatically open the generated video link, which can cause an external URL to be launched without an explicit user confirmation step. Even if the URL usually comes from the expected API, automatically opening remote links increases phishing, drive-by download, and unsafe handler invocation risk if the upstream response is compromised or malformed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

Line L09 says results are recorded to veo_result.txt, which is a file write affecting user data/workspace state. The markdown describes the behavior but does not provide any caution or user warning about persistent storage, overwrite implications, or where the file will be created.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description is written only in Chinese ("即梦视频生成技能") with no indication that users can choose their preferred language or locale. This creates a natural-language policy concern because the skill presents a fixed language experience without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The function starts jimeng_worker.py as a detached background process with stdout and stderr suppressed to os.devnull. Although the return string later indicates a task was submitted, the execution site itself has no prompt, log, or comment warning that a separate process will be spawned and detached.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The returned status message is hard-coded in Chinese, which imposes a specific language on users without opt-in or explanation. Under the language/locale policy, fixed-language behavior should either offer a choice or clearly justify the locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.