wanjie-openclaw-video

• Outcome: Review
• Latest audit: May 28, 2026 · 2:44 PM UTC
• Version: 1.0.0

Overview

This video skill mostly matches its stated purpose, but it needs review because it uses local API keys, detached background execution, automatic link opening, and poorly scoped persistence/dependency behavior.

Review before installing. Use it only if you intend to send video prompts to Wanjie and have confirmed that the first API key in ~/.openclaw/openclaw.json is the intended Wanjie key. Be aware that it may run detached background jobs, may open returned links automatically, may write logs/result links on disk, and its documentation claims scheduled monitoring without clear disable or uninstall steps.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if platform.system() == 'Windows':
        os.startfile(url)
    elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

• Confidence: 92% confidence
• Finding: The code opens a URL supplied by a remote service using the OS default handler via `open`. Although arguments are passed safely as a list and there is no shell injection, this is still a dangerous execution side effect because untrusted remote output can trigger browser launches or invoke registered handlers for non-web schemes, leading to phishing, unwanted application launches, or local handler abuse.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

def is_process_running(pid):
    """检查指定 PID 的进程是否在运行"""

• Confidence: 92% confidence
• Finding: This Linux path has the same issue as the macOS one: it passes a remotely derived URL directly to `xdg-open`, which delegates to the system's default handlers. Even without shell interpolation, opening untrusted URLs can cause browser-based attacks, trigger custom URI handlers, or produce unexpected external side effects not justified by the script's narrow purpose.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

importlib.import_module("requests")
    except ImportError:
        print("[*] 正在安装缺失依赖: requests...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_veo_generation(prompt, model="veo3.1-fast", seconds=8):
    # 在触发前确保环境就绪

• Confidence: 97% confidence
• Finding: The code automatically runs pip at runtime to modify the Python environment without explicit user approval or any integrity controls such as version pinning or hash verification. This is dangerous because it expands the trust boundary to the package index and network path, creating supply-chain risk and allowing unexpected environment modification during normal skill execution.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script reads an API key from a local user configuration file without any visible disclosure, consent flow, or clear scoping to the current action. In an agent-skill context, silently harvesting local credentials increases risk because a user may not expect the skill to access secrets from their home directory and then use them for external requests.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill opens URLs via external OS handlers as part of normal execution, and those URLs are later sourced from remote model output. In this context that is an unjustified and dangerous side effect: a remote service effectively controls a local action on the user's machine, which can be abused for phishing, drive-by browser launches, or custom-protocol invocation.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill modifies the execution environment by installing Python packages during runtime, which is unsafe in a security-sensitive agent context. Even for a common package like requests, on-the-fly installation can introduce supply-chain exposure, unexpected privilege use, and non-reproducible behavior across runs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly tells users to ensure network connectivity so the skill can automatically download missing Python dependencies at runtime. This creates a supply-chain and environment-modification risk because code execution behavior depends on external package retrieval, but the documentation does not clearly warn about that behavior, pin versions, or describe trust boundaries.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation phrase "生成视频：[您的提示词]" is broad and underspecified, which can cause the skill to trigger on generic conversational text without clear user intent boundaries. In a skill that also launches background processing and automation, ambiguous triggering increases the chance of unintended execution and surprise actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation describes persistent background monitoring every 5 minutes, automatic dependency installation, log/result syncing, and installation of a Windows scheduled task, but does not present these as prominent user warnings requiring informed consent. Persistence plus scheduled execution materially increases security and privacy risk because users may unknowingly install software that continues running, modifies the host, and processes tasks outside the immediate chat interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill launches an external Python process in the background based directly on user input, with no confirmation, no visible audit trail, and no supervision of the spawned task. Although `spawn` is used with argument separation rather than a shell, this still creates a security and safety risk because arbitrary users can trigger resource-consuming external execution and the detached process can continue outside the agent lifecycle.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code accesses a sensitive credential from a local config file without notifying the user in code or requiring explicit configuration for this script. In a skill setting, silent secret access is risky because it expands the skill's privilege surface and can surprise users who did not grant or understand that level of access.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The package installation occurs automatically and silently from the standpoint of security control: the user is not asked to approve an environment change before pip is invoked. In agent or hosted environments, this can violate least surprise and policy expectations while enabling unwanted code retrieval and execution from external sources.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.25.1

• Confidence: 96% confidence
• Finding: The dependency is only lower-bounded and not pinned to a specific version, which makes builds non-reproducible and can cause the environment to resolve to different package versions over time. That increases supply-chain risk and can silently introduce breaking changes or newly introduced vulnerable releases into the skill.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The requirement allows installation of `requests` versions associated with multiple published advisories, and because it is specified as `>=2.25.1`, dependency resolution may select a vulnerable release. In an agent skill context that performs outbound HTTP requests, flaws in `requests` can lead to credential leakage, improper certificate verification behavior, or other network-security issues that materially increase exposure.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: hooks.js:11