wanjie-openclaw-video

• Outcome: Review
• Latest audit: May 28, 2026 · 2:44 PM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it needs Review because it can use a global OpenClaw API key, start detached background work, install Python packages at runtime, and automatically open remote result links.

Install only if you are comfortable with this skill starting detached Python processes, using an API key from your global OpenClaw config, sending prompts to Wanjie's API, possibly installing requests at runtime, writing local log/result files, and opening generated links automatically. Prefer a skill-scoped API key and review whether any scheduled task or background monitor is created after installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if platform.system() == 'Windows':
        os.startfile(url)
    elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

• Confidence: 91% confidence
• Finding: The script launches a URL returned from externally sourced model output using the local OS handler (`open`). Even though it avoids shell injection by passing arguments as a list, it still performs a dangerous action on untrusted data: arbitrary links can trigger browser launches, custom URI handlers, or other local applications without user confirmation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif platform.system() == 'Darwin':  # macOS
        subprocess.Popen(['open', url])
    else:  # Linux
        subprocess.Popen(['xdg-open', url])

def is_process_running(pid):
    """检查指定 PID 的进程是否在运行"""

• Confidence: 91% confidence
• Finding: On Linux, the script passes an untrusted URL to `xdg-open`, which can dispatch to browsers or registered URI handlers. This is not classic command injection because no shell is used, but it is still unsafe automatic execution of externally influenced content on the local machine.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

importlib.import_module("requests")
    except ImportError:
        print("[*] 正在安装缺失依赖: requests...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_veo_generation(prompt, model="veo3.1-fast", seconds=8):
    # 在触发前确保环境就绪

• Confidence: 93% confidence
• Finding: Installing packages at runtime executes pip against the current environment and may pull code from external package sources, creating a supply-chain and environment-integrity risk. In an agent skill context, this also allows unexpected network access and mutation of the host runtime during normal use, which is unsafe unless tightly controlled.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill includes the capability to open URLs directly on the host system, and the URL is later sourced from streamed remote content. In a skill with no declared permissions or documented need for local application launching, this materially increases risk because remote content can cause unsolicited browser/app execution.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script reads an API key from a user home-directory configuration file without any visible permission or disclosure boundary. Accessing local credentials broadens the trust scope of the skill and can enable unauthorized use of another service account if the skill is invoked unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill auto-installs a Python package when imported functionality is missing, which changes the execution environment and may download and execute untrusted code from package infrastructure at runtime. Because the skill purpose is not dependency management and there is no integrity verification, this behavior is risky in a security-sensitive agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code spawns a detached worker process and immediately returns success, which reduces visibility, weakens lifecycle control, and can leave background processes running outside normal supervision. In an agent setting, that makes auditing, resource control, and containment harder, especially because user-controlled inputs are passed through to another script whose behavior is not shown here.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly states that the skill may automatically download missing Python dependencies over the network and run background monitoring/restart behavior, but it does not clearly warn users about the resulting system changes, outbound network activity, or persistent execution. In an agent skill context, undocumented self-healing, polling, and auto-restart features increase the risk of unexpected package installation, long-running processes, and harder-to-audit behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation phrase is extremely broad ('生成视频：[您的提示词]') and does not describe any confirmation, scoping, or explicit invocation boundary. In an agent environment, broad triggers can cause unintended activation from normal conversation text, leading to unauthorized task execution or resource consumption.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes persistent background monitoring, automatic dependency installation, file output, timeout cleanup, and creation of a Windows scheduled task without prominently warning the user about these system changes. Persistence plus autonomous execution materially increases risk because it can continue operating after the initial interaction, modify the host environment, and create opportunities for abuse or hard-to-notice unwanted behavior.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script silently loads a local API key and immediately uses it to send a prompt to an external service. This is dangerous because users may not realize their stored credentials are being reused or that their prompt data is being transmitted off-host under that credential.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: hooks.js:11