Auto Video Editor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 2.0.0

Overview

The skill is mostly a coherent local video-editing toolkit, but it has review-worthy risks from unsafe rendering defaults, unpinned installs/downloads, broad local indexing, and hidden branding in one cover style.

Install only if you are comfortable with a local video-editing skill that can read and index project media, write generated media/transcripts/indexes, install external dependencies, and download fonts/models. Review generated techcard covers for unwanted OpenClaw branding, prefer pinned dependencies and lockfiles, avoid running sudo/PPA commands unless you trust them, and consider disabling remote font use or Chrome --no-sandbox before using cover generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: scripts/generate_cover_image.py:513

Finding

Undisclosed Hard-Coded Promotional Branding in Generated Covers

Content

View full analysis

OPENCLAW SKILL

{title_html}

{"

" + sub_html + "

" if sub_html else ""}

Open source and free

Runs locally

Tutorial-oriented

``` The three chip strings above are English translations of the corresponding hard-coded non-English source literals. ### Technical Analysis The `techcard` cover template inserts fixed OpenClaw branding and promotional claims independently of the user-provided title, subtitle, or source video. The Skill documentation presents `techcard` as a general cover style for software tutorials but does not clearly disclose that selecting it permanently adds these labels. This is an output-integrity issue rather than a system-privilege escalation. The generated asset may assert that unrelated content is an OpenClaw Skill, is open source, runs locally, or is tutorial-oriented without verifying those claims. The behavior is deterministic and cannot be disabled through the documented render configuration. It therefore exceeds what is necessary to generate a generic tutorial cover. ### Attack Path 1. A user asks the agent to generate a software-tutorial cover. 2. The agent selects the documented `techcard` style. 3. `generate_cover()` invokes the `_style_techcard()` template. 4. The template inserts the hard-coded badge and promotional labels. 5. Headless Chrome renders the labels into the final cover image. 6. The user may publish an incorrectly branded or misleading image without realizing that the labels were added automatically. ### Impact Assessment No additional operating-system privileges are obtained. The affected scope is ...[truncated 329 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_cover_image.py:550

Finding

Headless Chrome Cover Rendering Disables the Browser Sandbox

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: remotion-standup/package.json:11

Finding

Unpinned Dependencies and Unverified Font Downloads Create Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 2. Install Python dependencies with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 3. Replace npm caret ranges with reviewed versions where practical. 4. Commit a package lockfile generated from trusted dependencies. 5. In documentation and automation, use: ```bash npm ci ``` rather than unconstrained `npm install`. 6. Review transitive dependencies and package lifecycle scripts before release. 7. Maintain expected SHA-256 hashes for every downloadable font. 8. Download to a temporary file, verify its digest and basic font structure, and atomically move it into the cache only after validation succeeds. 9. Reject unexpected redirects or restrict redirects to an explicit host allowlist. 10. Record the source URL, version, license, file size, and digest for each bundled or downloaded font. 11. Prefer shipping reviewed font assets with the Skill when licensing permits. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (83)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full-featured automated video editing skill, but the supplied code only manages a local media asset index. Its commands are init/scan/status/search/upgrade, and its core behavior is organizing folders, scanning media files, classifying by type/category, extracting metadata via get_video_info, associating preexisting transcript JSON files, and persisting/searching the index in JSON or SQLite. It does not invoke ffmpeg, whisper, Remotion, Node.js, or implement any editing/rendering/transcription pipeline. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 459)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 503)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 710)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 865)May include surrounding context.

md

python3 scripts/render_final.py --config render_config.json --output final.mp4 --subtitle-style karaoke

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 853)May include surrounding context.

解决：

bash

sudo apt update && sudo apt install ffmpeg

如果系统源的 ffmpeg 版本过旧（< 4.0），使用 PPA：

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 858)May include surrounding context.

解决：

bash

sudo apt update && sudo apt install ffmpeg

如果系统源的 ffmpeg 版本过旧（< 4.0），使用 PPA：

bash

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · docs/plans/2026-03-29-video-skill-v2.md (reported line 936)May include surrounding context.

md

---

### Task 6: Update SKILL.md — Media Library + AI Workflow

**Files:**
- Modify: `SKILL.md`

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · docs/plans/2026-03-29-video-skill-v2.md (reported line 1074)May include surrounding context.

bash

git add SKILL.md
git commit -m "feat: update SKILL.md with media library, AI clip selection, filler detection, multi-format"

---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation is entirely presented in Chinese and is framed around Chinese short-video platforms and Chinese-user defaults, without offering an explicit language or locale choice. This can constitute a natural-language policy issue because the skill appears to assume a specific language/locale rather than making it user-selectable.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

Ubuntu/Debian/WSL：

bash

sudo apt install ffmpeg fonts-noto-cjk

Windows：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 770)May include surrounding context.

Ubuntu/Debian/WSL：

bash

sudo apt install ffmpeg fonts-noto-cjk

Windows：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 818)May include surrounding context.

Ubuntu/Debian/WSL：

bash

sudo apt install ffmpeg fonts-noto-cjk

Windows：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 853)May include surrounding context.

Ubuntu/Debian/WSL：

bash

sudo apt install ffmpeg fonts-noto-cjk

Windows：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 857)May include surrounding context.

Ubuntu/Debian/WSL：

bash

sudo apt install ffmpeg fonts-noto-cjk

Windows：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 858)May include surrounding context.

Ubuntu/Debian/WSL：

bash

sudo apt install ffmpeg fonts-noto-cjk

Windows：

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README tells users to invoke the skill by simply using natural language such as “帮我剪一下…”, and states that the AI will automatically call the scripts. This trigger wording is broad everyday speech and does not define boundaries, exclusions, or a specific command form, which could lead to unintended invocation overlap with general editing requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The README instructs users to run npx remotion without pinning a specific package version. That makes builds non-reproducible and can expose users to unexpected or malicious upstream package changes at execution time, especially because npx may fetch code on demand.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide begins with core usage instructions in Chinese, and the document consistently presents operational guidance, examples, and defaults in Chinese. This effectively imposes a language/locale constraint on users without opt-in or explanation, which matches the policy category for natural-language locale violations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs use of shell commands, file reads/writes, environment inspection, package installs, and network-backed tooling, but declares no explicit tool scope or permissions boundaries. In an agentic environment, this increases the chance the skill can trigger overly broad host access or surprise execution paths without policy guardrails.

Content

No source excerpt is available for this finding.