wanjie-openclaw-video

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 1.0.0

Overview

This video-generation skill is mostly coherent, but it uses broad credentials, detached background execution, automatic URL opening, runtime package installation, and claimed scheduled monitoring without enough user control.

Review before installing. Only use this if you are comfortable with it reading your OpenClaw API-key config, sending prompts and a bearer token to Wanjie's service, launching detached Python workers, possibly installing Python packages, opening returned links automatically, and potentially relying on background monitoring. Prefer a version that asks for a Wanjie-specific key, pins dependencies, validates result-link domains, asks before opening links, and documents how to disable any scheduled task.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if platform.system() == 'Windows':
        os.startfile(url)
    elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

• Confidence: 83% confidence
• Finding: subprocess.Popen(['open', url])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

def is_process_running(pid):
    """检查指定 PID 的进程是否在运行"""

• Confidence: 83% confidence
• Finding: subprocess.Popen(['xdg-open', url])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

importlib.import_module("requests")
    except ImportError:
        print("[*] 正在安装缺失依赖: requests...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_veo_generation(prompt, model="veo3.1-fast", seconds=8):
    # 在触发前确保环境就绪

• Confidence: 94% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill can launch an extracted URL in the local browser/app, and that URL originates from remote model output parsed with only a loose regex. In this skill context, auto-launching remote content is more dangerous because the external service is not fully trusted and can influence host-side behavior beyond simple data retrieval.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script reads API credentials from a user home-directory configuration file without scoping access to only a declared provider or environment variable. In an agent skill, silent credential harvesting from user-space configuration increases sensitivity because the skill gains access to secrets not provided explicitly for this execution context.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill both modifies the local environment by installing packages and launches a separate local worker process, yet no security boundary, approval step, or stated operational need justifies those capabilities. In an agent-skill context, these behaviors increase the attack surface by enabling persistent side effects outside the immediate tool invocation path.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that missing Python dependencies may be downloaded automatically if the environment has network access, but it does not clearly warn users that installation will modify the runtime environment and initiate external network communication. In an agent skill context, undocumented self-installation behavior increases supply-chain and environment-integrity risk, especially when paired with autonomous background execution and self-healing behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill can be activated by a very broad natural-language phrase ('生成视频：[...]') with no confirmation step, scope restriction, or explicit opt-in for side effects. In this skill's context, that is risky because activation appears to trigger background processing and system changes, making accidental or unintended execution more likely.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The markdown explicitly describes automatic background monitoring, scheduled execution every 5 minutes, automatic dependency installation, forced timeout cleanup, file output, and Windows Task Scheduler persistence without a prominent warning or explicit user consent. This is dangerous because it introduces persistent system modifications and ongoing autonomous behavior that can continue outside the user's immediate interaction, increasing the risk of misuse, surprise execution, and stealthy resource or data impacts.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Automatically installing a missing dependency via pip without warning or confirmation is dangerous because it changes the host environment and may execute untrusted package installation code. In a skill environment, users may not expect the tool to fetch and install software, making this a meaningful trust and supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.25.1

• Confidence: 97% confidence
• Finding: requests>=2.25.1

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: requests

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: hooks.js:11