wanjie-openclaw-video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 2.0.0

Overview

This video-generation skill is purpose-aligned at a high level, but it handles local API credentials, background execution, package installation, logging, and browser opening with too little scoping and user control.

Review carefully before installing. Only use this with a dedicated Wanjie/OpenClaw API key that you are willing to send to wanjiedata.com, avoid sensitive prompt content, expect background Python processes and local logs, and do not rely on it unless you accept automatic dependency installation and automatic browser opening of returned links.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: model/scripts/veo_worker.py:65

Finding

Unrelated Provider API Credential Sent to a Hard-Coded Third-Party Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: model/scripts/veo_worker.py:36

Finding

Untrusted API Response URL Automatically Opened in the Default Browser

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: model/scripts/video_interface.py:7

Finding

Automatic Installation of an Unpinned Runtime Dependency

Content

View full analysis

=2.25.1 ``` ### Technical Analysis If `requests` is unavailable, ordinary skill execution invokes `pip install requests` against the environment's configured package index. The runtime installation has no exact version, hash verification, lockfile, isolated environment, or explicit user approval. Although `requests` is a legitimate package name and there is no direct evidence of typosquatting or a malicious package in the reviewed project, this pattern delegates code selection to the current package index at execution time. A compromised index, hostile mirror configuration, dependency compromise, or incompatible future release could introduce unreviewed code into the runtime. The lower-bound-only requirement likewise allows future versions that were not part of this audit. ### Attack Path 1. The skill runs in a Python environment where `requests` is not installed. 2. `ensure_dependencies()` catches the import failure. 3. The skill invokes `pip` automatically. 4. `pip` resolves the package using the machine's active index and configuration. 5. The selected package and its transitive dependencies are installed without project-controlled hashes. 6. Installation or subsequent import executes code that was not included in the audited artifact. Exploitation requires influence over the package source, dependency resolution, or a future package release; the audited code d ...[truncated 537 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: model/scripts/veo_worker.py:75

Finding

User Prompts and API-Key Fingerprints Persisted in Plaintext Logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly states that the skill may automatically download missing Python dependencies over the network and automatically restart background processes, but it does not clearly warn users that installation/runtime behavior can modify the environment and initiate network activity. In an agent skill context, undocumented self-healing and restart behavior increases risk because it can mask persistence, surprise users, and make system or network changes without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation phrase is effectively unconstrained natural-language input ('生成视频：[您的提示词]'), which makes accidental or overly permissive triggering more likely in chat contexts. Because the skill also describes automatic background processing, broad triggering increases the chance that ordinary conversation text could initiate actions without sufficiently explicit user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill discloses persistent background behavior, periodic monitoring, file output, automatic dependency installation, and Windows Task Scheduler registration, but does not present a clear, prominent warning or explicit consent flow for those persistence mechanisms. This is dangerous because users may unknowingly install a skill that creates long-lived background execution and scheduled tasks, which can consume resources, persist beyond the chat session, and mask unwanted behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill only activates on the Chinese prefix '生成视频：' and responds in Chinese, imposing a specific language without offering any user choice or documenting a justified locale restriction. This is a natural-language policy concern because the language constraint is embedded directly in the interaction behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code launches a detached Python subprocess to generate a video in the background, which is a safety-relevant operation under the subprocess/shell execution criterion. Although there is a reply after spawning, the code provides no confirmation prompt, pre-execution warning, or explanatory comment disclosing that a background process will be started before the action occurs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The worker has an unjustified capability to launch external URLs automatically, and the URL source is the remote model/API response rather than a trusted local decision. In the context of an otherwise background video-generation worker, this is risky because it can drive the user into malicious web content or invoke local protocol handlers without clear consent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

This launches the system URL handler on a URL derived from streamed model/API output without validating the scheme, domain, or trustworthiness of the destination. Even though shell injection is avoided by using an argument list, it still enables untrusted remote content to trigger browser or protocol-handler launches on the user's machine.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 44)May include surrounding context.

python

if platform.system() == 'Windows':
            os.startfile(url)
        elif platform.system() == 'Darwin':  # macOS
            subprocess.Popen(['open', url])
        else:  # Linux
            subprocess.Popen(['xdg-open', url])
    except Exception as e:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

On Linux, the code invokes xdg-open on a URL extracted from untrusted response content, which can open a browser or other registered handler for arbitrary schemes. This expands the attack surface to phishing pages or dangerous custom URI handlers controlled by remote output.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 46)May include surrounding context.

python

elif platform.system() == 'Darwin':  # macOS
            subprocess.Popen(['open', url])
        else:  # Linux
            subprocess.Popen(['xdg-open', url])
    except Exception as e:
        log_exc("[!] 打开URL失败", e)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · model/scripts/veo_worker.py (reported line 60)May include surrounding context.

python

# 没有 psutil:Windows 用 tasklist 粗略判断;其他平台保守不删锁
        try:
            if platform.system() == 'Windows':
                res = subprocess.run(['tasklist', '/FI', f'PID eq {pid}'],
                                     capture_output=True, text=True)
                return str(pid) in res.stdout
        except Exception:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script reads an API key from a local ~/.openclaw config file, giving it access to credentials outside its immediate input surface. In an untrusted skill context, that is an unnecessary secret-access capability and can be abused to use or expose the user's existing credentials without clear authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code silently accesses a local API key from a user config file, which is sensitive local state, without clear disclosure or opt-in. In a skill setting, covert credential access is especially concerning because users may not expect this component to inherit secrets from another tool's configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

User-supplied prompt content is sent to an external third-party API without any visible disclosure, consent flow, or minimization controls in this file. If prompts contain sensitive data, this creates a confidentiality risk through silent data transfer to an outside service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script automatically opens a URL returned by remote output without user warning or approval, creating a silent external interaction with the user's desktop environment. This can facilitate phishing, drive-by navigation, or invocation of non-browser URI handlers depending on platform configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Comments and user-facing messages in the file are written only in Chinese, including the returned status message and installation notice. This appears to impose a specific language on user-visible communication without offering a language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill can modify the environment by installing packages at runtime despite limited declared context about why this capability is needed. In agent environments, self-modifying behavior reduces predictability and can be abused to fetch unreviewed code or alter system state beyond the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatically installing a missing dependency via pip without explicit user confirmation is a real security issue in agent skills. It creates an unreviewed network-enabled code acquisition path and may surprise users by altering the system or pulling packages from untrusted sources.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The code automatically invokes pip at runtime to install a package if it is missing. Runtime package installation changes the execution environment without user approval and can introduce supply-chain risk, especially if package indexes, mirrors, or environment settings are compromised.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 13)May include surrounding context.

python

importlib.import_module("requests")
    except ImportError:
        print("[*] 正在安装缺失依赖: requests...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests"])

def trigger_veo_generation(prompt, model="veo3.1-fast", seconds=8):
    # 在触发前确保环境就绪

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill launches another script as a detached worker process without transparent justification, and it suppresses output from that worker. In a security review context, this is risky because it enables hidden execution paths and makes it difficult to verify what actions are being taken on the host.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

This launches a detached subprocess and suppresses all stdout/stderr, making the worker's behavior opaque to the caller and harder to monitor or audit. Even though shell injection is not present because arguments are passed as a list, stealthy background execution increases the risk of abuse if the worker script is modified or behaves unexpectedly.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 32)May include surrounding context.

python

if platform.system() == 'Windows':
        # 将输出重定向到 NUL 以防止 OpenClaw 报错
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, creationflags=subprocess.CREATE_NEW_PROCESS_GROUP)
    else:
        # Linux/macOS 上启动新进程
        with open(os.devnull, 'w') as devnull:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

This starts a new background session on Unix-like systems while redirecting output to /dev/null, which conceals execution and breaks normal observability. The danger is not command injection here, but the combination of detached execution and hidden output, which can mask unintended or unauthorized actions by the worker process.

Content

Scanner excerpt · model/scripts/video_interface.py (reported line 36)May include surrounding context.

python

else:
        # Linux/macOS 上启动新进程
        with open(os.devnull, 'w') as devnull:
            subprocess.Popen(cmd, stdout=devnull, stderr=devnull, start_new_session=True)
        
    return f"[*] 任务已提交: {prompt}，请在聊天窗口耐心等待结果通知。"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function logs input including the model argument and accepts --model from the CLI, implying the selected model is used for generation. However, the outgoing payload always sets "model": "veo3.1", so the observable behavior contradicts the apparent intent communicated by the interface/logging.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.25.1, which allows installation of many different future and past-compatible versions rather than a reviewed, fixed release. This weakens supply-chain control and can lead to builds pulling in vulnerable or unexpected versions over time, especially when the package has a history of security advisories.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.25.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest references requests without pinning to a specific version, while the package has multiple known security advisories across its release history. Because the resolved version is not fixed, it is impossible to verify from this file alone whether deployment will use a safe release, creating avoidable exposure to known vulnerable versions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: hooks.js:11