ClawHub
Back to skill

Security audit

Video Reverse Prompt

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly performs video analysis by sending user-chosen videos or video URLs to NanoPhoto.AI, with no evidence of hidden persistence, unrelated data access, or deceptive behavior.

Install only if you are comfortable sending selected videos, video URLs, and generated analysis to NanoPhoto.AI for processing. Use the platform skill settings or NANOPHOTO_API_KEY environment variable for the API key rather than passing it with --api-key, and avoid uploading private, regulated, or third-party content unless you have authorization.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/reverse_prompt_file.py:26
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/reverse_prompt_file.py, lines 26 and 32
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--api-key", help="NanoPhoto API key. Defaults to NANOPHOTO_API_KEY env var.")
python
api_key = args.api_key or __import__("os").environ.get("NANOPHOTO_API_KEY")

Technical Analysis

The upload helper accepts the NanoPhoto API key through the --api-key command-line option. Secrets passed as command-line arguments can be exposed through shell history, process inspection, endpoint telemetry, audit logs, or diagnostic tooling.

Although the Skill documentation recommends secure environment-variable configuration, the executable interface explicitly supports this less secure credential-delivery method. An attacker still requires access to process information, command history, or collected telemetry; this is not a remote credential disclosure by itself.

The credential is legitimately needed to authenticate with the fixed NanoPhoto HTTPS endpoint. The vulnerability concerns how it may be supplied locally, not its authorized transmission in the Authorization header.

Attack Path

  1. A user invokes the helper with a command such as:

    bash
    python3 scripts/reverse_prompt_file.py video.mp4 --api-key SECRET_VALUE

  2. The command and API key are retained in shell history, exposed temporarily through the process argument vector, or captured by local monitoring and telemetry.

  3. An attacker with access to that information retrieves the API key.

  4. The attacker uses the key to authenticate unauthorized requests to the NanoPhoto API.

Impact Assessment

Successful exploitation may allow unauthorized use of the victim's NanoPhoto service identity, consumption of account credits, and API activity attributed to the victim. This issue does not grant operating-system privilege escalatio ...[truncated 377 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key command-line option and require NANOPHOTO_API_KEY to be supplied through the platform's protected Skill configuration or another secret-management mechanism.
  2. If interactive credential entry is required, use getpass.getpass() so the key is not echoed or included in the process argument vector.
  3. Update help text and documentation to prohibit placing credentials directly in commands.
  4. Ensure application and infrastructure logs redact the Authorization header and any API-key values.
  5. Advise users who previously passed keys through --api-key to clear affected shell history where appropriate and rotate potentially exposed credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The code’s core purpose aligns with the declared NanoPhoto.AI reverse-prompt functionality for video analysis, and the API key prerequisite is consistent. However, the declared description explicitly claims support for YouTube links, direct .mp4 URLs, and local file upload, while this code chunk only handles a local .mp4 file path. There is no logic for parsing or submitting YouTube URLs or remote MP4 URLs. This is a material description-to-behavior mismatch in supported input sources, even though the broader domain purpose is consistent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents capabilities that read local files and transmit data over the network, but it does not declare any explicit tool scope or allowed-tools constraints. This weakens least-privilege controls and increases the chance the runtime grants broader access than users or reviewers expect.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: video-reverse-prompt
description: "Analyze videos to extract reverse prompts, shot-by-shot breakdowns, and AI-ready visual descriptions via the NanoPhoto.AI Video Reverse Prompt API. Use when: (1) User wants reverse prompt, prompt extraction, or video-to-prompt analysis, (2) User provides a YouTube link, direct MP4 URL, or local MP4 file and wants a shot list / storyboard-style breakdown, (3) User mentions video analysis, shot breakdown, extract prompt from video, NanoPhoto, or reverse engineer a video prompt. Supports YouTube links, direct .mp4 URLs, and local file upload. Prerequisite: Obtain an API key at https://nanophoto.ai/settings/apikeys and configure env.NANOPHOTO_API_KEY."
homepage: https://nanophoto.ai
metadata: {"openclaw":{"homepage":"https://nanophoto.ai","requires":{"env":["NANOPHOTO_API_KEY"]},"primaryEnv":"NANOPHOTO_API_KEY"}}
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow instructs the operator to upload local video files or submit remote video URLs to a third-party API, but it lacks an explicit user-facing privacy and data-sharing warning. Users may unknowingly send sensitive or proprietary video content off-platform, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill explicitly sends user-supplied video references and authorization credentials to an external service. External transmission is expected for this skill, but it remains security-relevant because sensitive media or internal URLs could be disclosed to a third party if the user is not adequately informed or inputs are not constrained.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

YouTube Video

bash
curl -X POST "https://nanophoto.ai/api/sora-2/reverse-prompt" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NANOPHOTO_API_KEY" \
  --data-raw '{

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
# Video Reverse Prompt API Reference

## Endpoint

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# Video Reverse Prompt API Reference

## Endpoint

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/api.md (reported line 1)May include surrounding context.

md
# Video Reverse Prompt API Reference

## Endpoint

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · scripts/reverse_prompt_file.py (reported line 22)May include surrounding context.

python
# Video Reverse Prompt API Reference

## Endpoint

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly supports uploading local MP4 files and sending them to a third-party API, but it does not warn users that potentially sensitive video content will leave the local environment. In a skill context, that omission is security-relevant because users may provide private recordings, internal materials, or regulated data without informed consent about external disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The example code performs an external POST request to nanophoto.ai containing base64-encoded local video data and an API key. External transmission is expected for this skill's purpose, but it remains a real data-exfiltration surface because local media and possibly sensitive metadata are sent off-host to a remote service.

Content

Scanner excerpt · references/api.md (reported line 90)May include surrounding context.

md
const videoBuffer = await readFile("your-video.mp4");
const videoBase64 = videoBuffer.toString("base64");

const response = await fetch("https://nanophoto.ai/api/sora-2/reverse-prompt", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/reverse_prompt_file.py (reported line 31)May include surrounding context.

python
parser.add_argument("--retry-delay", type=float, default=3.0, help="Initial retry delay in seconds; doubles after each attempt (default: 3.0)")
    args = parser.parse_args()

    api_key = args.api_key or __import__("os").environ.get("NANOPHOTO_API_KEY")
    if not api_key:
        fail("Missing API key. Set NANOPHOTO_API_KEY or pass --api-key.")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code hard-codes Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 even though the CLI separately accepts a user-selected --locale from many supported locales. This creates a natural-language/locale policy issue because the request always signals a Chinese language preference without explicit user opt-in or alignment with the chosen locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.