ClawHub
Back to skill

Security audit

Sora 2 Generate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward NanoPhoto video-generation integration with expected API-key and third-party transmission risks that are mostly disclosed and purpose-aligned.

Install only if you are comfortable sending prompts, public image URLs, task IDs, and the NanoPhoto API key to NanoPhoto.AI. Prefer the platform secure environment variable for NANOPHOTO_API_KEY, avoid --api-key on shared or logged systems, and do not use private or sensitive images unless you intend to share them with the service.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sora2_generate.py:173
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
None: parser.add_argument("--api-key", help="NanoPhoto API key") parser.add_argument("--timeout", type=int, default=60, help="Per-request timeout in seconds (default: 60)") parser.add_argument("--user-agent", default=DEFAULT_USER_AGENT, help="HTTP User-Agent override") ``` ### Technical Analysis The script permits the NanoPhoto API key to be supplied through the `--api-key` command-line option. Command-line arguments are not an appropriate secret-delivery mechanism because they can be exposed through: - Shell command history. - Process inspection utilities and operating-system process interfaces. - Diagnostic, monitoring, or audit systems that record process command lines. - Wrapper scripts, CI logs, or terminal session recordings. The script subsequently uses this value as a bearer credential for requests to the fixed NanoPhoto HTTPS API endpoints. Network transmission of the key to NanoPhoto is necessary for the declared video-generation functionality, but accepting it through a command-line argument unnecessarily expands its local exposure. The script already supports safer credential sources: the `NANOPHOTO_API_KEY` environment variable and the skill-specific entry in `~/.openclaw/openclaw.json`. No transmission of unrelated credentials or configuration values was identified. ### Attack Path 1. A user runs the script with `--api-key`, for example: ```bash python3 scripts/sora2_generate.py submit --api-key SECRET_VALUE --prompt "Example" ``` 2. The complete command is retained in shell history, captured by process monitoring, or temporarily exposed through the operating system's process list. 3. Another local user, process, log reader, or monitoring ...[truncated 985 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill clearly relies on sensitive capabilities—network access, environment variable access, and reading a local config fallback file—but does not declare an explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and makes it harder for a host platform or reviewer to constrain what the skill can access, increasing the risk of overbroad execution privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: sora-2-generate
description: "Generate videos with the NanoPhoto.AI Sora 2 API in text-to-video or image-to-video mode. Use when: (1) User wants to create a Sora 2 video from a prompt, (2) User provides one or more public image URLs and wants image-to-video generation, (3) User mentions Sora 2, NanoPhoto video generation, text to video, image to video, cinematic prompt generation, or checking Sora generation status. Supports submission, status checks, and optional in-process polling from a single bundled script. Prerequisite: Obtain an API key at https://nanophoto.ai/settings/apikeys and configure env.NANOPHOTO_API_KEY."
homepage: https://nanophoto.ai
metadata: {"openclaw":{"homepage":"https://nanophoto.ai","requires":{"env":["NANOPHOTO_API_KEY"]},"primaryEnv":"NANOPHOTO_API_KEY"}}
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user prompts and image URLs to a third-party service, but the description does not prominently warn users that their content leaves the local environment and is processed externally. This creates a privacy and consent risk, especially if users provide sensitive prompts, proprietary creative concepts, or private image links without realizing they will be transmitted off-platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This skill intentionally transmits user-supplied prompts and image URLs, along with an authorization token, to an external API endpoint. While this is necessary for the advertised functionality, it is still a genuine data exfiltration surface because any sensitive user content included in prompts or URLs will be sent to a third party.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

Submit generation

bash
curl -X POST "https://nanophoto.ai/api/sora-2/generate" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NANOPHOTO_API_KEY" \
  --data-raw '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation instructs users to submit public image URLs and use API-key-authenticated requests, but it does not warn that images and prompts are transmitted to a third-party service and that image-to-video requires publicly accessible URLs. This can lead users to unintentionally expose sensitive images, metadata, or private resources if they convert internal or personal content into public links for compatibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code sends the generation payload and authorization-bearing requests to nanophoto.ai, including user-supplied prompts and optional image URLs. While the CLI help describes functionality, there is no explicit warning in code comments, docstrings, or user-facing output that user content will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script resolves the API key not only from the declared environment variable but also from ~/.openclaw/openclaw.json, which widens the trust boundary and may cause it to use credentials from an unexpected local source. This can lead to accidental credential use, cross-skill secret exposure, or operation under the wrong account, especially in shared or multi-skill environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.