ClawHub
Back to skill

Security audit

Sora Video Generation

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it generates Sora videos through OpenAI's API, with ordinary API-key and file-output risks that users should understand.

Install only if you are comfortable sending video prompts and any reference images to OpenAI for processing. Prefer OPENAI_API_KEY from a protected environment or secret manager instead of --api-key, review dependency resolution if you need reproducible installs, and choose output paths carefully because the script writes the requested MP4 file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_video.py:2
Finding

Unpinned Runtime Dependencies Allow Unreviewed Package Versions

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_video.py, lines 2-8
Vulnerability Type: Supply-chain risk caused by minimum-only dependency constraints
Risk Level: Medium

Vulnerable Code:

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "openai>=1.0.0",
#     "httpx>=0.25.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The inline dependency metadata specifies only minimum acceptable versions. It does not pin exact reviewed releases or provide integrity hashes. When the documented uv run invocation resolves these dependencies, it may install future package versions that were not present during this audit.

This creates a non-reproducible execution environment and expands the supply-chain attack surface. If a permitted future release is compromised, dependency resolution can introduce and execute malicious package code when the script imports openai, httpx, or PIL. The use of legitimate package names reduces dependency-confusion risk, but unrestricted future versions still create an unsafe dependency update path.

Attack Path

  1. An attacker compromises a future release of one of the declared packages or its publishing process.
  2. The malicious release remains compatible with the minimum-only version constraint.
  3. A user invokes the Skill through the documented uv run command in an environment without a locked dependency set.
  4. The resolver downloads and installs the compromised release.
  5. The script imports the affected package.
  6. Package initialization or imported functionality executes attacker-controlled code with the permissions of the user running the Skill.

Impact Assessment

A malicious dependency would execute with the same local privileges as the Skill process. Depending on those privileges, it could read accessible files and environment variables, including OPENAI_API_KEY, modify user-owned files, make ...[truncated 233 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every dependency to an exact, reviewed version rather than using minimum-only constraints.
  • Generate and commit a lockfile that records the full transitive dependency graph.
  • Require package hashes or another integrity-verification mechanism where supported.
  • Resolve packages only from explicitly configured, trusted registries.
  • Perform dependency upgrades through a controlled review and testing process.
  • Use automated vulnerability and provenance scanning before approving updated packages.
  • Run the Skill with least privilege and expose only the files and environment variables required for video generation.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_video.py:122
Finding

OpenAI API Key Can Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_video.py, lines 122-125
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Low

Vulnerable Code:

python
parser.add_argument(
    "--api-key", "-k",
    help="OpenAI API key (overrides OPENAI_API_KEY env var)"
)

Technical Analysis

The script permits an OpenAI API key to be supplied directly as a command-line argument. Command-line secrets may be recorded in interactive shell history, terminal logs, process-monitoring systems, audit logs, automation logs, or process argument listings.

Although the script also supports OPENAI_API_KEY, retaining the command-line option encourages a less secure credential-delivery method. The script does not print the key itself, and exploitation requires access to one of the local or operational records containing the command invocation.

Attack Path

  1. A user invokes the script with --api-key or -k followed by a valid OpenAI API key.
  2. The command and key are retained in shell history, automation logs, process telemetry, or a process argument listing.
  3. A local user, monitoring process, log reader, or other actor with access to that record retrieves the key.
  4. The actor uses the exposed credential to authenticate to OpenAI services until the key is revoked or expires.

Impact Assessment

Exposure may allow unauthorized use of the affected OpenAI account or project within the permissions assigned to the key. Potential consequences include consumption of API quota, generation charges, access to API resources available to that credential, and disruption through quota exhaustion.

This issue does not directly grant operating-system privilege escalation. Its practical scope depends on the key's configured permissions, billing limits, lifetime, and the attacker's ability to inspect process metadata or command records.

Remediation
View remediation

Remediation Suggestions

  • Remove the --api-key and -k command-line options.
  • Obtain the credential from a protected environment variable, operating-system keychain, secret manager, or permission-restricted credential file.
  • For interactive use, accept secrets through a non-echoing prompt rather than through process arguments.
  • Ensure CI and automation platforms inject the credential through their native secret-management facilities and mask it in logs.
  • Assign the API key only the permissions required for video generation and apply appropriate usage or billing limits.
  • Rotate the key immediately if it has previously appeared in shell history, logs, or process telemetry.
  • Document secure credential handling and advise users not to place secrets in command-line arguments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 28)May include surrounding context.

python
def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("OPENAI_API_KEY")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents use of environment variables and outbound network access but do not declare any tool scope such as permissions or allowed-tools. This creates a mismatch between what the skill can do and what is explicitly constrained, increasing the chance that an agent invokes it with broader capabilities than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill when the user asks to generate, create, or make videos, which are broad trigger phrases that can match many benign or ambiguous requests. Overly broad invocation criteria can cause the agent to activate this skill unnecessarily, leading to unintended external API calls or transmission of user content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown describes using prompts and optional reference images with a remote API but does not clearly warn that this content is sent to an external service. Users may provide sensitive text or private images without understanding the disclosure, creating confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
"""Download video content using httpx."""
    import httpx
    
    url = f"https://api.openai.com/v1/videos/{video_id}/content"
    headers = {"Authorization": f"Bearer {api_key}"}
    
    try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 77)May include surrounding context.

python
"""Download video content using httpx."""
    import httpx
    
    url = f"https://api.openai.com/v1/videos/{video_id}/content"
    headers = {"Authorization": f"Bearer {api_key}"}
    
    try: