ClawHub
Back to skill

Security audit

Sora Video Generation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward OpenAI Sora video helper with expected API-key use and OpenAI network calls, though users should prefer environment-based credentials and be aware of dependency/version risk.

Install only if you are comfortable sending prompts and optional reference images to OpenAI for video generation. Prefer setting OPENAI_API_KEY through your environment or secret manager instead of passing --api-key on the command line, and consider locking dependency versions before using it in sensitive environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_video.py:2
Finding

Unpinned Runtime Dependencies Permit Unreviewed Package Versions

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_video.py:2-8
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "openai>=1.0.0",
#     "httpx>=0.25.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

All third-party dependencies use open-ended minimum-version constraints. The documented uv run workflow can consequently resolve versions released after the Skill was reviewed. The project contains no lockfile or package hashes that constrain resolution to known, reviewed artifacts.

This does not establish that any currently available dependency is malicious. It creates a supply-chain exposure in which a future compromised, malicious, or unexpectedly incompatible release satisfying the constraints may be installed and executed automatically. Python package installation or import-time code can run with the privileges of the user invoking the Skill.

Attack Path

  1. An attacker compromises the publication account, build process, or distribution artifact of one of the permitted dependencies.
  2. The attacker publishes a higher version satisfying the applicable lower-bound constraint.
  3. A user invokes the documented uv run command in an environment that has not locked or cached a reviewed version.
  4. The resolver downloads and installs the attacker-controlled release.
  5. Malicious installation-time or import-time code executes with the invoking user's privileges.
  6. The payload may read the OpenAI API key, prompts, reference images, accessible local files, or perform other actions allowed to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running the Skill. The resulting access would be bounded by that account's operating-system permissions but could include the OPENAI_API_KEY, command-line ...[truncated 181 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every dependency to an exact, reviewed version rather than using open-ended lower bounds.
  • Generate and commit a lockfile that records all direct and transitive dependency versions.
  • Require package hashes where the selected tooling supports hash verification.
  • Install packages only from explicitly configured trusted indexes.
  • Update dependencies through a controlled process incorporating source review, vulnerability scanning, and automated tests.
  • Consider executing video generation in a sandbox with minimal filesystem access, restricted credentials, and constrained network access to reduce the effect of a supply-chain compromise.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_video.py:123
Finding

OpenAI API Key Can Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_video.py:123-126
Additional Documentation Location: SKILL.md:76-82
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable code:

python
parser.add_argument(
    "--api-key", "-k",
    help="OpenAI API key (overrides OPENAI_API_KEY env var)"
)

Related documented usage:

markdown
| `--api-key`, `-k` | OpenAI API key | env var |

## API Key

Set `OPENAI_API_KEY` environment variable or pass `--api-key`.

Technical Analysis

The script accepts a long-lived API credential directly as a command-line argument, and the documentation explicitly presents this as a supported credential-delivery mechanism. Command-line arguments can be retained in shell history and may be collected by process-monitoring, auditing, telemetry, job orchestration, or diagnostic systems. Depending on operating-system policy, process arguments may also be observable by other local users while the command is running.

The script does not print the key itself, and using the environment-variable alternative avoids placing it directly in the argument list. Nevertheless, supporting and recommending --api-key increases the probability of accidental plaintext credential disclosure.

Attack Path

  1. A user invokes the script with --api-key <secret>.
  2. The shell records the complete command in its history, or a process/audit monitoring system captures the argument vector.
  3. Another local user, administrator, log reader, support operator, or compromised monitoring component obtains access to that retained data.
  4. The observer extracts the OpenAI API key.
  5. The exposed credential is used to issue unauthorized API requests until it is revoked or otherwise restricted.

Impact Assessment

Exploitation does not directly grant local privilege escalation. It can grant the attacker the OpenAI API permiss ...[truncated 279 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the --api-key command-line option and its recommendation from SKILL.md.
  • Retrieve the credential from a dedicated secret manager, protected environment injection mechanism, or credential file with restrictive permissions.
  • If interactive entry is required, use a no-echo prompt such as getpass.getpass() rather than an argument.
  • If backward compatibility requires retaining the option, emit a prominent warning explaining that command-line secrets may enter shell history and process logs.
  • Scope the API key to the minimum required project and permissions, configure usage limits where available, and rotate any key suspected of exposure.
  • Ensure logs, telemetry, and exception handlers redact authorization credentials and secret-bearing arguments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 28)May include surrounding context.

python
def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("OPENAI_API_KEY")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill invokes a script that uses environment variables and makes outbound network requests to the OpenAI API, but the manifest declares no explicit tool scope or permissions. This creates an authorization gap: an agent may execute capabilities broader than the skill metadata communicates, reducing reviewability and increasing the chance of unintended secret access or network use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
"""Download video content using httpx."""
    import httpx
    
    url = f"https://api.openai.com/v1/videos/{video_id}/content"
    headers = {"Authorization": f"Bearer {api_key}"}
    
    try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 77)May include surrounding context.

python
"""Download video content using httpx."""
    import httpx
    
    url = f"https://api.openai.com/v1/videos/{video_id}/content"
    headers = {"Authorization": f"Bearer {api_key}"}
    
    try:

Static analysis

No suspicious patterns detected.