ClawHub
Back to skill

Security audit

wanjie-openclaw-video

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill is mostly purpose-aligned, but it handles credentials and remote results in ways users should review before installing.

Install only if you are comfortable with a Wanjie-hosted service receiving your video prompts and a configured API key. Use a dedicated low-quota Wanjie key, verify it is the only or explicitly selected credential, and review or disable the automatic browser opening, runtime pip install, background worker, logs, and any scheduled task behavior before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
model/scripts/veo_worker.py:65
Finding

Disclosure of an Arbitrary OpenClaw Provider API Key to an External Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
model/scripts/veo_worker.py:102
Finding

Automatic Opening of an Unvalidated URL from Model-Controlled Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
model/scripts/video_interface.py:7
Finding

Runtime Installation of an Unpinned Python Dependency

Content
View full analysis
=2.25.1 ``` ### Technical Analysis When `requests` is unavailable, the interface invokes pip during normal skill execution. The package name has no exact version or integrity hash, and pip uses the interpreter's configured package index and trust settings. The lower-bound-only requirement also permits future versions that were not part of this audit. Runtime installation modifies the host Python environment and can execute package installation code. Risk increases if the host uses a compromised or attacker-controlled package index, proxy, mirror, or pip configuration. The audited package name is the legitimate `requests` name rather than an observed typosquat. Therefore, this finding concerns unsafe resolution and installation practices, not proof that a malicious dependency is currently included. ### Attack Path 1. The skill is invoked through `trigger_veo_generation` on a Python environment where `requests` is absent. 2. `ensure_dependencies()` catches `ImportError`. 3. The code launches `python -m pip install requests`. 4. Pip resolves the package and its transitive dependencies using locally configured indexes and network settings. 5. A compromised index, mirror, account, network trust configuration, or future malicious release supplies attacker-controlled package content. 6. Installation or later import executes that content with the privileges of the user running the skill ...[truncated 549 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script extracts the first URL from remote response text and immediately opens it on the host machine. Because the response is network-controlled, this creates a direct remote-to-local action channel that can drive users to phishing pages, malware delivery, or dangerous custom URI schemes without review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger instruction requires the user to input the Chinese phrase 生成视频：[您的视频描述], and the document provides no alternative language option or explanation that the skill is intentionally Chinese-only. This is a natural-language locale constraint that is not presented as an opt-in choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly states that missing Python dependencies may be downloaded automatically once the environment has network access, but it does not provide a clear warning that running the skill can cause outbound network activity and modify the local environment. In an agent skill context, silent dependency installation increases supply-chain and change-management risk because users may trigger code execution without realizing packages will be fetched from external sources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger phrase is extremely broad: users are told to simply type a natural-language request like “生成视频：[提示词]”, while the skill also claims it intercepts instructions and automatically invokes background processing. Without clear boundaries, confirmation, or exclusion rules, normal conversation can unintentionally trigger task execution, causing unexpected API usage, background activity, and file/log generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill discloses persistent background monitoring, automatic dependency installation, log/file output, timeout cleanup, and creation of a Windows scheduled task, but does not provide meaningful user consent, scope limitation, or risk disclosure. This behavior increases the attack surface because it enables persistence-like execution, silent system changes, and possible leakage of prompts or generated content into logs and local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code spawns a detached Python process to generate a video and only informs the user afterward that generation is happening in the background. There is no confirmation prompt, pre-execution disclosure, or inline warning before launching the subprocess, which is a safety-relevant operation for code files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's comments, log messages, and result strings are written in Chinese, and the generated request content also appends Chinese text later in the file. There is no mechanism for user locale choice or opt-in, which violates the policy against forcing a specific language without user selection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script includes capability to open arbitrary URLs in the local system handler/browser, which can trigger navigation to attacker-controlled content or invocation of registered URI handlers. In an agent skill with no clearly declared permission model, this expands from simple browsing into local side effects driven by untrusted remote content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 17)May include surrounding context.

python
if platform.system() == 'Windows':
        os.startfile(url)
    elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 19)May include surrounding context.

python
elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

def is_process_running(pid):
    """检查指定 PID 的进程是否在运行"""

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 30)May include surrounding context.

python
# 如果没有 psutil，使用简单但有效的方法
        import subprocess
        if platform.system() == 'Windows':
            res = subprocess.run(['tasklist', '/FI', f'PID eq {pid}'], capture_output=True, text=True)
            return str(pid) in res.stdout
        return True # 默认不删除锁，以防误删

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code reads an API key from a user home-directory configuration file without any visible permission boundary or user consent flow. In a skill context, accessing local secrets is sensitive because the skill can use credentials the user did not intend to expose to this specific component.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code modifies the prompt by appending the Chinese phrase '，时长 {seconds} 秒', forcing a Chinese-language instruction into the model request regardless of user preference. This is a natural-language locale constraint with no opt-in or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The script transmits user-supplied prompt content and model selection to an external API endpoint, authenticated with a locally sourced API key. External transmission is expected for API-backed functionality, but in the absence of declared permissions and data-handling notice, it is still a real confidentiality concern for prompts that may contain sensitive data.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 80)May include surrounding context.

python
}
        
        print(f"[*] API 请求发送中... (Model: {model})", flush=True)
        res = requests.post("https://maas-openapi.wanjiedata.com/api/v1/chat/completions", 
            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
            json=payload, stream=True)

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The script transmits user-supplied prompt content and model selection to an external API endpoint, authenticated with a locally sourced API key. External transmission is expected for API-backed functionality, but in the absence of declared permissions and data-handling notice, it is still a real confidentiality concern for prompts that may contain sensitive data.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 80)May include surrounding context.

python
}
        
        print(f"[*] API 请求发送中... (Model: {model})", flush=True)
        res = requests.post("https://maas-openapi.wanjiedata.com/api/v1/chat/completions", 
            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
            json=payload, stream=True)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code both installs packages at runtime and spawns a detached worker process, which changes the environment and execution model beyond a simple library-style helper. In the absence of explicit skill metadata justifying environment modification and background execution, this is risky because it hides side effects, complicates auditing, and increases the chance of abuse or persistence-like behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Running pip automatically without a user-facing warning or confirmation is unsafe because it performs privileged environment changes and may execute untrusted installation-time code paths from dependency sources. Users and operators are denied the chance to review what will be installed, from where, and under which permissions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

Automatically invoking pip at runtime modifies the host environment without explicit user approval and executes package installation logic from configured package indexes. In a skill context, this can introduce supply-chain risk, unexpected code execution during install, and non-deterministic behavior if indexes or dependencies are tampered with.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 13)May include surrounding context.

python
importlib.import_module("requests")
    except ImportError:
        print("[*] 正在安装缺失依赖: requests...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_veo_generation(prompt, model="veo3.1-fast", seconds=8):
    # 在触发前确保环境就绪

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 31)May include surrounding context.

python
# 跨平台进程启动设置
    if platform.system() == 'Windows':
        # Windows 上使用 CREATE_NEW_PROCESS_GROUP
        subprocess.Popen(cmd, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        # Linux/macOS 上启动新进程
        subprocess.Popen(cmd, start_new_session=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 34)May include surrounding context.

python
subprocess.Popen(cmd, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        # Linux/macOS 上启动新进程
        subprocess.Popen(cmd, start_new_session=True)
        
    return f"[*] 任务已提交: {prompt}，请在聊天窗口耐心等待结果通知。"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file uses Chinese for comments, docstrings, print output, and the returned user-facing status message, with no indication that the user can choose another language. This creates a language-policy concern because the skill imposes a specific language/locale without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency is specified as requests>=2.25.1, which allows installation of a wide range of versions and makes builds non-reproducible. This is dangerous because a vulnerable or unintended future release could be pulled in, and it also prevents reviewers from verifying exactly which version is used.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.25.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
95% confidence
Finding

requests has multiple known advisories, and because the manifest does not pin a specific version, there is no reliable way to determine whether an affected release may be installed. This is risky because deployments may resolve to different versions over time, potentially introducing a known vulnerable package into the skill.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
hooks.js:11