Auto Video Editor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 2.0.0

Overview

The skill is mostly a coherent local video-editing toolkit, but it has review-worthy risks from unsafe rendering defaults, unpinned installs/downloads, broad local indexing, and hidden branding in one cover style.

Install only if you are comfortable with a local video-editing skill that can read and index project media, write generated media/transcripts/indexes, install external dependencies, and download fonts/models. Review generated techcard covers for unwanted OpenClaw branding, prefer pinned dependencies and lockfiles, avoid running sudo/PPA commands unless you trust them, and consider disabling remote font use or Chrome --no-sandbox before using cover generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: scripts/generate_cover_image.py:513
• Finding: Undisclosed Hard-Coded Promotional Branding in Generated Covers<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_cover_image.py:513-520` **Vulnerability Type**: Undisclosed output manipulation **Risk Level**: High ### Vulnerable Code ```python <div class="copy"> <div class="badge">OPENCLAW SKILL</div> <div class="title">{title_html}</div> {"<div class='subtitle'>" + sub_html + "</div>" if sub_html else ""} <div class="chips"> <div class="chip">Open source and free</div> <div class="chip">Runs locally</div> <div class="chip">Tutorial-oriented</div> </div> ``` The three chip strings above are English translations of the corresponding hard-coded non-English source literals. ### Technical Analysis The `techcard` cover template inserts fixed OpenClaw branding and promotional claims independently of the user-provided title, subtitle, or source video. The Skill documentation presents `techcard` as a general cover style for software tutorials but does not clearly disclose that selecting it permanently adds these labels. This is an output-integrity issue rather than a system-privilege escalation. The generated asset may assert that unrelated content is an OpenClaw Skill, is open source, runs locally, or is tutorial-oriented without verifying those claims. The behavior is deterministic and cannot be disabled through the documented render configuration. It therefore exceeds what is necessary to generate a generic tutorial cover. ### Attack Path 1. A user asks the agent to generate a software-tutorial cover. 2. The agent selects the documented `techcard` style. 3. `generate_cover()` invokes the `_style_techcard()` template. 4. The template inserts the hard-coded badge and promotional labels. 5. Headless Chrome renders the labels into the final cover image. 6. The user may publish an incorrectly branded or misleading image without realizing that the labels were added automatically. ### Impact Assessment No additional operating-system privileges are obtained. The affected scope is ...[truncated 329 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all fixed branding and promotional claims from the generic `techcard` template. 2. Add optional configuration fields such as: - `cover_badge` - `cover_chips` - `include_branding` 3. Default all branding fields to empty or disabled. 4. Require explicit user consent before inserting product names, logos, affiliations, or promotional claims. 5. Do not infer claims such as “open source” or “runs locally” from the selected visual style. 6. Document every template element that may be added to final user-visible output. 7. Add tests verifying that a cover generated with only a title contains no additional promotional text. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_cover_image.py:550
• Finding: Headless Chrome Cover Rendering Disables the Browser Sandbox<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_cover_image.py:82-85, 432, 550-558` **Vulnerability Type**: Unsafe browser process configuration **Risk Level**: Medium ### Vulnerable Code The viewport probe disables the sandbox: ```python cmd = [ chrome_path, "--headless", "--disable-gpu", "--no-sandbox", "--dump-dom", f"--window-size={width},{height}", f"file://{probe_path}", ] ``` The main screenshot process also disables it: ```python cmd = [ chrome_path, "--headless", "--disable-gpu", "--disable-software-rasterizer", "--no-sandbox", "--disable-dev-shm-usage", "--hide-scrollbars", f"--screenshot={raw_output}", f"--window-size={width},{screenshot_height}", "--force-device-scale-factor=1", f"file://{html_path}", ] ``` The `white` template permits a network request during rendering: ```css @import url('https://fonts.googleapis.com/css2?family=Noto+Sans+SC:wght@500;900&display=swap'); ``` ### Technical Analysis Chrome’s sandbox is a principal defense against renderer and resource-processing vulnerabilities. Both browser invocations explicitly pass `--no-sandbox`, causing browser content to be processed without that containment boundary. Most cover HTML is generated locally, which reduces immediate exposure. However, the `white` style imports a remote Google Fonts stylesheet. This causes an unannounced network request from the unsandboxed browser and introduces remotely supplied CSS and font resources into the rendering process. This finding does not establish a standalone browser compromise. Successful system compromise would additionally require a vulnerability in the installed Chrome version or one of its content parsers. Nevertheless, disabling the sandbox substantially increases the impact of such a vulnerability and is unnecessary for normal desktop cover generation. ### Attack Path 1. The user or agent requests a cover using the `white` style. 2. The script creates local HTML containing a Google ...[truncated 1192 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` from both Chrome command lines. 2. Run Chrome under an unprivileged account and preserve its standard sandbox configuration. 3. Replace the remote Google Fonts import with a verified, locally cached font. 4. Disable browser networking during screenshot generation where supported. 5. If sandbox disabling is unavoidable in a constrained container: - Use a dedicated non-root user. - Use a read-only root filesystem. - Mount only the required temporary and output directories. - Drop Linux capabilities. - Apply seccomp and AppArmor or SELinux restrictions. - Block unnecessary outbound network access. 6. Keep Chrome updated through a trusted package source. 7. Add an automated test that inspects Chrome arguments and fails if `--no-sandbox` is reintroduced outside an explicitly isolated environment. ]]>

T08 · Insecure Dependencies

Warning

• Location: remotion-standup/package.json:11
• Finding: Unpinned Dependencies and Unverified Font Downloads Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-25, 525`; `remotion-standup/package.json:11-24`; `scripts/utils.py:563-571` **Vulnerability Type**: Insufficient dependency and downloaded-asset integrity controls **Risk Level**: Medium ### Vulnerable Code The installation instructions do not constrain Python package versions: ```bash pip install faster-whisper pip install openai-whisper pip install faster-whisper -i https://pypi.tuna.tsinghua.edu.cn/simple ``` The Remotion workflow instructs users to resolve dependencies dynamically: ```bash npm install ``` The package manifest uses broad compatible-version ranges: ```json "dependencies": { "@remotion/cli": "^4.0.0", "@remotion/media-utils": "^4.0.0", "@remotion/transitions": "^4.0.0", "@remotion/google-fonts": "^4.0.0", "@remotion/fonts": "^4.0.0", "react": "^18.3.0", "react-dom": "^18.3.0", "remotion": "^4.0.0" }, "devDependencies": { "@types/react": "^18.3.0", "typescript": "^5.4.0" } ``` No npm lockfile was present in the audited project structure. Downloaded font data is written directly to the cache without an integrity check: ```python for url in urls: try: os.makedirs(fonts_dir, exist_ok=True) print(f"[font] Downloading {display_name}...") req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"}) with urllib.request.urlopen(req, timeout=60) as resp: with open(target_path, "wb") as f: f.write(resp.read()) size_mb = os.path.getsize(target_path) / (1024 * 1024) print(f"[font] Downloaded: {target_path} ({size_mb:.1f} MB)") return target_path, display_name ``` ### Technical Analysis The Python installation commands select whichever package versions are current when the user runs them. The npm manifest permits compatible updates through caret ranges, and the absence of a lockfile prevents reproducible dependency resolution. These conditions allow the code i ...[truncated 2587 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact Python dependency versions in a requirements file, for example: ```text faster-whisper==<reviewed-version> --hash=sha256:<reviewed-hash> ``` 2. Install Python dependencies with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 3. Replace npm caret ranges with reviewed versions where practical. 4. Commit a package lockfile generated from trusted dependencies. 5. In documentation and automation, use: ```bash npm ci ``` rather than unconstrained `npm install`. 6. Review transitive dependencies and package lifecycle scripts before release. 7. Maintain expected SHA-256 hashes for every downloadable font. 8. Download to a temporary file, verify its digest and basic font structure, and atomically move it into the cache only after validation succeeds. 9. Reject unexpected redirects or restrict redirects to an explicit host allowlist. 10. Record the source URL, version, license, file size, and digest for each bundled or downloaded font. 11. Prefer shipping reviewed font assets with the Skill when licensing permits. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (83)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a full-featured automated video editing skill, but the supplied code only manages a local media asset index. Its commands are init/scan/status/search/upgrade, and its core behavior is organizing folders, scanning media files, classifying by type/category, extracting metadata via get_video_info, associating preexisting transcript JSON files, and persisting/searching the index in JSON or SQLite. It does not invoke ffmpeg, whisper, Remotion, Node.js, or implement any editing/rendering/transcription pipeline. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Chaining Abuse

High

• Category: Tool Misuse

Content

**解决**：
```bash
sudo apt update && sudo apt install ffmpeg
```
如果系统源的 ffmpeg 版本过旧（< 4.0），使用 PPA：
```bash

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

**解决**：
```bash
sudo apt update && sudo apt install ffmpeg
```
如果系统源的 ffmpeg 版本过旧（< 4.0），使用 PPA：
```bash

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Self-Modification

High

• Category: Rogue Agent

Content

---

### Task 6: Update SKILL.md — Media Library + AI Workflow

**Files:**
- Modify: `SKILL.md`

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

```bash
git add SKILL.md
git commit -m "feat: update SKILL.md with media library, AI clip selection, filler detection, multi-format"
```

---

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill documentation is entirely presented in Chinese and is framed around Chinese short-video platforms and Chinese-user defaults, without offering an explicit language or locale choice. This can constitute a natural-language policy issue because the skill appears to assume a specific language/locale rather than making it user-selectable.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Ubuntu/Debian/WSL：**
```bash
sudo apt install ffmpeg fonts-noto-cjk
```

**Windows：**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Ubuntu/Debian/WSL：**
```bash
sudo apt install ffmpeg fonts-noto-cjk
```

**Windows：**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Ubuntu/Debian/WSL：**
```bash
sudo apt install ffmpeg fonts-noto-cjk
```

**Windows：**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Ubuntu/Debian/WSL：**
```bash
sudo apt install ffmpeg fonts-noto-cjk
```

**Windows：**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Ubuntu/Debian/WSL：**
```bash
sudo apt install ffmpeg fonts-noto-cjk
```

**Windows：**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Ubuntu/Debian/WSL：**
```bash
sudo apt install ffmpeg fonts-noto-cjk
```

**Windows：**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The README tells users to invoke the skill by simply using natural language such as “帮我剪一下…”, and states that the AI will automatically call the scripts. This trigger wording is broad everyday speech and does not define boundaries, exclusions, or a specific command form, which could lead to unintended invocation overlap with general editing requests.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The README instructs users to run `npx remotion` without pinning a specific package version. That makes builds non-reproducible and can expose users to unexpected or malicious upstream package changes at execution time, especially because `npx` may fetch code on demand.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The guide begins with core usage instructions in Chinese, and the document consistently presents operational guidance, examples, and defaults in Chinese. This effectively imposes a language/locale constraint on users without opt-in or explanation, which matches the policy category for natural-language locale violations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs use of shell commands, file reads/writes, environment inspection, package installs, and network-backed tooling, but declares no explicit tool scope or permissions boundaries. In an agentic environment, this increases the chance the skill can trigger overly broad host access or surprise execution paths without policy guardrails.

Static analysis

No suspicious patterns detected.