ClawHub
Back to skill

Security audit

Veo 3.1

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed NanoPhoto video-generation integration, with the main risk being normal third-party API use and avoidable API-key handling through a command-line option.

Install only if you are comfortable sending generation prompts, task IDs, and any provided public image URLs to NanoPhoto. Configure NANOPHOTO_API_KEY through the platform's secure environment setting, avoid using --api-key on the command line, and do not include secrets or private media in prompts or image URLs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/veo_3_1.py:226
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/veo_3_1.py, lines 226 and 264
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

The script permits users to provide the NanoPhoto API key through the --api-key command-line argument and gives that value precedence during credential resolution.

python
def add_common_auth_args(parser: argparse.ArgumentParser) -> None:
    parser.add_argument("--api-key", help="NanoPhoto API key")
    parser.add_argument("--timeout", type=int, default=60, help="Per-request timeout in seconds (default: 60)")
    parser.add_argument("--user-agent", default=DEFAULT_USER_AGENT, help="HTTP User-Agent override")
python
def main() -> None:
    parser = build_parser()
    args = parser.parse_args()

    api_key = resolve_api_key(getattr(args, "api_key", None))
    if not api_key:
        fail("Missing API key. Pass --api-key, set NANOPHOTO_API_KEY, or configure ~/.openclaw/openclaw.json skills.entries.veo-3-1.env.NANOPHOTO_API_KEY.")

Technical Analysis

Command-line arguments are not an appropriate transport for long-lived secrets. A command such as:

bash
python3 scripts/veo_3_1.py submit --api-key SECRET_VALUE ...

may expose the credential through shell-history files, process listings, process-monitoring software, diagnostic reports, terminal logging, or automation logs. Depending on the operating system and its process-inspection controls, other local users or monitoring agents may be able to inspect the argument while the process is running.

This behavior is unnecessary because the script already supports the more appropriate NANOPHOTO_API_KEY environment variable and a narrowly scoped OpenClaw configuration entry. The affected credential is subsequently used as the bearer token for requests to the fixed NanoPhoto HTTPS endpoints.

Attack Path

  1. A user follows the suppo ...[truncated 1394 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key command-line option and its precedence in resolve_api_key.
  2. Prefer secret injection through the declared NANOPHOTO_API_KEY environment variable or the platform's protected Skill configuration.
  3. If interactive credential entry is required, use Python's getpass.getpass() so the key is not echoed or placed in process arguments.
  4. Update SKILL.md, command help, and error messages so they no longer recommend or advertise command-line credential submission.
  5. Ensure the OpenClaw configuration file containing the fallback credential has restrictive filesystem permissions and is readable only by the owning account.
  6. Advise users who previously used --api-key to remove affected shell-history and automation-log entries and rotate potentially exposed keys.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: veo-3-1
description: "Generate videos with the NanoPhoto.AI Veo 3.1 API. Use when: (1) User wants Veo 3.1 text-to-video generation, (2) User wants Veo 3.1 generation from reference images or first/last frames, (3) User wants multi-shot long-form Veo video generation, or (4) User wants to check Veo generation status. Supports up to 21 shots, 720p/1080p/4k output rules, status checks, and optional in-process polling from a single bundled script. Prerequisite: Obtain an API key at https://nanophoto.ai/settings/apikeys and configure env.NANOPHOTO_API_KEY."
metadata: {"openclaw":{"homepage":"https://nanophoto.ai","requires":{"env":["NANOPHOTO_API_KEY"]},"primaryEnv":"NANOPHOTO_API_KEY"}}
---

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents capabilities to read environment variables, read a local fallback config file, and make outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a transparency and governance gap: an agent may use broader capabilities than a reviewer expects, increasing the risk of unintended secret access or network exfiltration in environments that rely on declared scopes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill sends user-supplied prompts and an authorization bearer token to an external third-party service. While this is expected for a video-generation integration, it is still a real data egress path that can expose sensitive prompts, metadata, and credentials if users misunderstand what is transmitted or if the endpoint is misused.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

Submit generation

bash
curl -X POST "https://nanophoto.ai/api/veo-3/generate" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NANOPHOTO_API_KEY" \
  --data-raw '{

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file instructs users to place an API key in an environment variable and skill metadata, which involves handling sensitive credentials. The reference does not include any warning or disclosure about protecting the key, avoiding commits/logging, or treating it as secret material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.