ClawHub
Back to skill

Security audit

wanjie-openclaw-video

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill has a coherent purpose, but it automatically uses local API credentials, sends them to a hard-coded external service, and opens returned URLs without confirmation.

Review carefully before installing. Use only a dedicated, low-quota Wanjie API key, do not keep unrelated provider keys as the first OpenClaw provider entry, and avoid use until the skill requires explicit confirmation before network calls and browser opening, pins dependencies, and documents how to disable any background monitoring.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
model/scripts/veo_worker.py:67
Finding

Arbitrary OpenClaw Provider Credential Transmitted to an External Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
model/scripts/veo_worker.py:108
Finding

Untrusted API Response URL Is Automatically Opened

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
model/scripts/video_interface.py:7
Finding

Runtime Installation of an Unpinned Third-Party Dependency

Content
View full analysis
=2.25.1 ``` ### Technical Analysis If `requests` is unavailable, the skill automatically invokes pip at runtime and installs a package into the active Python environment. The installation does not specify: - An exact reviewed version. - Cryptographic package hashes. - A locked transitive dependency graph. - An isolated virtual environment. - A trusted or explicitly configured package index. - A requirement that installation be performed as a separate, user-approved setup operation. The `requirements.txt` lower-bound constraint permits future releases that were not present during the audit. Runtime installation also means package installation behavior depends on the current pip configuration, configured indexes, mirrors, network state, and available package versions. No evidence in the audited artifact proves that the current `requests` package is malicious. The issue is the unsafe and non-reproducible dependency acquisition mechanism. ### Attack Path 1. The interface is invoked in an environment where `requests` cannot be imported. 2. `ensure_dependencies()` automatically executes pip. 3. Pip consults the environment's configured package indexes or mirrors. 4. It resolves a mutable version of `requests` and mutable transitive dependencies. 5. If an index, mirror, account, dependency release, or local pip configuration is compromised, attacker-controlle ...[truncated 839 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (24)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README describes a natural-language trigger and fully automated background execution, but it does not narrowly define what inputs are allowed or what safety checks constrain activation. In a skill that can launch long-running generation jobs, broad trigger wording increases the chance of accidental invocation, prompt misuse, or unreviewed task execution, especially when paired with auto-restart and polling behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrase is very broad ('生成视频：[您的提示词]') and the document says commands are intercepted automatically, which increases the chance of unintended activation from ordinary conversation. In the context of a skill that launches background processing and writes results to files, ambiguous triggering can cause unauthorized or unexpected task execution rather than a harmless UX issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly describes persistent background monitoring every 5 minutes, automatic task handling, dependency installation, timeout cleanup, file output, and Windows scheduled-task deployment, but does not provide clear user warnings, consent, or operational boundaries. This is dangerous because it establishes a persistence mechanism and ongoing filesystem activity that could surprise users, consume resources, or be abused for unauthorized automated behavior in an agent environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation phrase and response string are hard-coded in Chinese, which imposes a specific language requirement without offering the user a choice. This is a natural-language policy concern because the skill only appears usable for Chinese-language input and output with no documented opt-in or locale justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill spawns a detached Python process to generate a video in the background, which is a subprocess execution covered by the missing-warning rule for code files. Although the return message tells the user after launching that generation is happening, there is no prior confirmation, visible logging, or explanatory comment intended for the user about this background process behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 17)May include surrounding context.

python
if platform.system() == 'Windows':
        os.startfile(url)
    elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 19)May include surrounding context.

python
elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

def is_process_running(pid):
    """检查指定 PID 的进程是否在运行"""

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 30)May include surrounding context.

python
# 如果没有 psutil，使用简单但有效的方法
        import subprocess
        if platform.system() == 'Windows':
            res = subprocess.run(['tasklist', '/FI', f'PID eq {pid}'], capture_output=True, text=True)
            return str(pid) in res.stdout
        return True # 默认不删除锁，以防误删

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script reads an API key from a user home-directory configuration file and uses it without any visible disclosure, consent, or validation of necessity. In a skill context, silent credential access increases the risk of unauthorized use of the user's provider account and makes the behavior harder for users to audit or safely approve.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code silently extracts an API key from a local config file and immediately uses it in an outbound request. In a skill environment, undeclared credential use is dangerous because it can consume paid resources, act on behalf of the user without informed approval, and normalize hidden secret access patterns that are hard to distinguish from exfiltration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The outbound POST itself is not inherently malicious, but it becomes a real security concern in context because it combines external data transmission with hidden credential usage from the user's home directory. That creates account-abuse and transparency risks even if the intended function is legitimate video generation or link retrieval.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 80)May include surrounding context.

python
}
        
        print(f"[*] API 请求发送中... (Model: {model})", flush=True)
        res = requests.post("https://maas-openapi.wanjiedata.com/api/v1/chat/completions", 
            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
            json=payload, stream=True)

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The outbound POST itself is not inherently malicious, but it becomes a real security concern in context because it combines external data transmission with hidden credential usage from the user's home directory. That creates account-abuse and transparency risks even if the intended function is legitimate video generation or link retrieval.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 80)May include surrounding context.

python
}
        
        print(f"[*] API 请求发送中... (Model: {model})", flush=True)
        res = requests.post("https://maas-openapi.wanjiedata.com/api/v1/chat/completions", 
            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
            json=payload, stream=True)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

A video interface helper should not silently modify the Python environment during normal execution unless that behavior is clearly declared and consented to. Runtime package installation broadens the skill's capabilities beyond its apparent purpose and can introduce arbitrary third-party code into the environment, making the context more dangerous because users would not reasonably expect environment mutation here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Installing a Python package automatically without meaningful warning or confirmation is an unsafe software practice because it executes trust-sensitive actions in the user's environment. This is especially concerning in a helper script where users expect application logic, not package management with network and code-execution implications.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
93% confidence
Finding

Automatically invoking pip at runtime changes the local environment and executes package installation logic without explicit user approval. Even though the package name is hardcoded, this exposes users to unintended code execution through package install hooks, dependency confusion or index compromise, and breaks the principle of least surprise for a helper script.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 13)May include surrounding context.

python
importlib.import_module("requests")
    except ImportError:
        print("[*] 正在安装缺失依赖: requests...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_veo_generation(prompt, model="veo3.1-fast", seconds=8):
    # 在触发前确保环境就绪

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function spawns a detached background worker process, allowing code to continue running outside the initiating interaction and reducing user visibility and control. In the context of an undeclared video helper, that capability is riskier because it can persist work, consume resources, or perform follow-on actions without clear supervision or lifecycle management.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 31)May include surrounding context.

python
# 跨平台进程启动设置
    if platform.system() == 'Windows':
        # Windows 上使用 CREATE_NEW_PROCESS_GROUP
        subprocess.Popen(cmd, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        # Linux/macOS 上启动新进程
        subprocess.Popen(cmd, start_new_session=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 34)May include surrounding context.

python
subprocess.Popen(cmd, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        # Linux/macOS 上启动新进程
        subprocess.Popen(cmd, start_new_session=True)
        
    return f"[*] 任务已提交: {prompt}，请在聊天窗口耐心等待结果通知。"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

整个技能说明均以中文呈现，且未说明是否支持其他语言或允许用户自行选择语言。若组织要求避免在无用户选择的情况下强制特定语言，这种单一语言约束可能构成自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The comment states that old results should be read first and that an existing success should not be overwritten, but the implementation immediately opens veo_result.txt in write mode and replaces its contents. This is a direct contradiction between the documented intent and the actual file-writing behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

User-visible output and inline natural-language documentation in this file are written only in Chinese, including the returned status message and printed installation notice. This can violate language/locale policy when the skill does not offer any language choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The code does return a message that a task was submitted, but it does not clearly disclose that a detached OS-level background process is being launched and left running independently. This lack of transparency weakens user consent and operational awareness, though the impact is lower than direct code-execution issues because the launched script path is fixed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is specified as requests>=2.25.1, which allows any future version and does not guarantee a reproducible or reviewed install set. This is dangerous because builds may silently pull in an unexpected release, including one with breaking changes or a known vulnerable version, making security posture non-deterministic.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.25.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

requests has multiple known advisories, and because the manifest does not pin an exact version, it is impossible to verify whether installations will resolve to an affected release. The danger is less about a guaranteed vulnerable package in the file today and more that the open-ended specifier permits insecure versions or inconsistent environments over time.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
hooks.js:11