SiliconFlow Video Gen

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:32 PM UTC
• Version: 1.0.1

Overview

The skill appears to generate SiliconFlow videos as advertised, but it needs review because it uses broad command execution and places the API key in a child-process command line.

Review before installing. Use a limited SiliconFlow API key, avoid submitting confidential prompts or private image URLs, and prefer a version that replaces curl subprocess calls with an in-process HTTPS client so the API key is not exposed in process arguments. Do not run the unpinned installer with elevated privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.py:57

Finding

API Key Exposed Through Subprocess Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.py, lines 57-69
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code:

python

curl_cmd = [
    "curl", "-s", "-X", "POST",
    f"{API_BASE_URL}/video/submit",
    "-H", f"Authorization: Bearer {api_key}",
    "-H", "Content-Type: application/json",
    "-d", json.dumps(data),
    "--max-time", "30"
]

try:
    result = subprocess.run(curl_cmd, capture_output=True, text=True)

Technical Analysis

The SiliconFlow bearer token is embedded directly in the argument list passed to the curl subprocess. On systems where process arguments are visible through process inspection facilities, monitoring tools, audit logs, or process-listing utilities, another local user or process may observe the complete Authorization header while the request is running.

Using an argument list avoids shell-command injection, but it does not protect sensitive values from process metadata exposure. The request should instead be made through an in-process HTTPS client so that the credential is carried only in application memory and the encrypted network request.

Attack Path

1. An attacker obtains local process-observation capability on the machine running the skill.
2. The victim invokes the video-generation script with a valid SiliconFlow API key.
3. The script starts curl with Authorization: Bearer <API_KEY> in its command-line arguments.
4. The attacker monitors process metadata and captures the authorization argument while curl is running.
5. The attacker reuses the captured credential to make unauthorized SiliconFlow API requests.

Exploitation requires local process visibility or access to tooling that records command-line arguments. It is not remotely exploitable solely through the prompt or image URL.

Impact Assessment

A successful attacker can obtain the Sili ...[truncated 329 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the curl subprocess with a maintained in-process HTTPS client, such as Python's urllib.request or a pinned HTTP library.
• Supply the bearer token through the HTTP client's header API rather than through child-process arguments.
• Configure explicit connection and response timeouts and validate HTTP status codes and response content.
• Ensure exception messages, debug logs, and API error handling never include authorization headers or the raw API key.
• If use of curl is unavoidable, provide sensitive configuration through a protected mechanism that does not expose it in process arguments, and restrict any temporary configuration file to owner-only permissions with reliable cleanup.
• Rotate the API key if there is reason to believe process arguments have already been collected or logged.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:26

Finding

Unpinned Package Execution in Documented Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-30
Vulnerability Type: Unpinned executable package and supply-chain exposure
Risk Level: Low

Vulnerable Code:

markdown

## Installation

```bash
npx clawhub install siliconflow-video-gen

text

The same installation pattern also appears in `README.md`, lines 12-15:

```markdown
## Installation

```bash
# Via ClawHub
npx clawhub install siliconflow-video-gen

text

### Technical Analysis

The documented command invokes `clawhub` through `npx` without specifying a reviewed version or integrity constraint. If the package is not already installed locally, `npx` may retrieve and execute the currently published package version. Consequently, the code executed during installation can change independently of the reviewed skill contents.

This is a supply-chain hardening issue rather than evidence that the current `clawhub` package is malicious. Exploitation depends on compromise or malicious replacement of the upstream package, its registry account, or a relevant dependency.

### Attack Path

1. An attacker compromises the package publisher, registry entry, release process, or an executable dependency used by the unpinned `clawhub` package.
2. The attacker publishes a modified package version containing malicious installation or runtime behavior.
3. A user follows the documented `npx clawhub install siliconflow-video-gen` command.
4. `npx` resolves and downloads the altered current package version.
5. The malicious package executes with the privileges of the installing user.

### Impact Assessment

If the upstream package is compromised, arbitrary code could execute under the installing user's account. The resulting scope could include access to that user's files, environment variables, OpenClaw configuration, and credentials available to the installation process. Administrative privileges are not inherently obtained unless the u
...[truncated 95 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer to a specifically reviewed release, for example npx clawhub@<reviewed-version> install siliconflow-video-gen.
• Document the expected official registry and publisher identity so users can verify the package source.
• Where supported, use a lockfile or package-integrity digest and verify signatures or checksums before execution.
• Review new installer versions before updating the documented pin.
• Apply the same pinned command consistently in both SKILL.md and README.md.
• Advise users not to run the installation command with administrative privileges unless explicitly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill includes credential access logic that reads secrets not only from the environment but also from a broader local OpenClaw configuration store. In this context, the additional secret-reading capability is more dangerous because the skill's purpose is media generation, not credential management, and agent skills should minimize access to unrelated user secrets.

Content

Scanner excerpt · scripts/generate.py (reported line 21)May include surrounding context.

python

DEFAULT_MODEL = "Wan-AI/Wan2.2-T2V-A14B"

def get_api_key():
    """Get API key from environment or OpenClaw config"""
    api_key = os.environ.get("SILICONFLOW_API_KEY")
    if api_key:
        return api_key

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes sending prompts and optional image URLs to SiliconFlow for video generation but does not clearly warn that user-supplied content is transmitted to an external third-party API. In an agent context, this omission increases the risk of unintentional disclosure of sensitive prompts, private image links, or internal data embedded in requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises automatic API key discovery from ~/.openclaw/openclaw.json but does not warn users that the skill may access locally stored credentials or explain how those secrets are handled. This can lead users to grant trust without understanding that a third-party skill may read sensitive local configuration and use the credential for external API requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub install ... without pinning a specific version, which allows whatever version is current at install time to execute on the user's system. If the package is compromised upstream or a breaking/malicious release is published, users may unknowingly run unreviewed code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares access to environment variables and local files and instructs users to run a local Python script, but it does not define any explicit tool scope or permissions boundary. In an agent ecosystem, this increases risk because the skill can read sensitive data such as API keys and configuration files without transparent least-privilege constraints, making misuse or overreach harder to audit.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 79% confidence

Finding

The installation command uses npx clawhub without pinning an exact version, which can cause users to fetch and execute whatever package version is current at install time. If the upstream package is compromised or a breaking/malicious release is published, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.py (reported line 17)May include surrounding context.

python

import time

# API Configuration
API_BASE_URL = "https://api.siliconflow.cn/v1"
DEFAULT_MODEL = "Wan-AI/Wan2.2-T2V-A14B"

def get_api_key():

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill silently reads an API key from the user's OpenClaw home-directory config in addition to the documented environment variable. In an agent-skill context, that expands credential access beyond what is necessary and can surprise users, especially since the key is then sent to an external service for network operations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 67)May include surrounding context.

python

]
    
    try:
        result = subprocess.run(curl_cmd, capture_output=True, text=True)
        if result.returncode != 0:
            return {"success": False, "error": f"API request failed: {result.stderr}"}

Tainted flow: 'curl_cmd' from os.environ.get (line 57, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate.py (reported line 67)May include surrounding context.

python

]
    
    try:
        result = subprocess.run(curl_cmd, capture_output=True, text=True)
        if result.returncode != 0:
            return {"success": False, "error": f"API request failed: {result.stderr}"}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.json (reported line 15)May include surrounding context.

json

"文生视频",
      "图生视频",
      "生成短视频",
      "create video",
      "generate video",
      "text to video",
      "image to video"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares the generic exec tool even though its documented purpose is only to call the SiliconFlow API for video generation. Exec grants arbitrary command execution capability, which is far broader than necessary and could be abused by later prompts or hidden implementation logic to read local files, access secrets, or run unintended system commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The OpenClaw Agent usage section provides invocation examples only in Chinese, which suggests a language-specific interaction pattern without stating that other languages are supported or that Chinese is required for a justified regional reason. This can amount to a language/locale policy issue because users are not given an explicit language choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Accessing sensitive credentials from a local config file without clear user-facing disclosure is a transparency and least-surprise issue. In a skill ecosystem, undisclosed secret discovery can enable unintended credential use and weakens trust boundaries even if the key is only used for its nominal API.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.