T06 · System Persistence
Warning
- Location
videoarm_local_whisper/setup.py:58- Finding
Automatic Installation of a Persistent macOS LaunchAgent
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Reader
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent video-analysis tool, but it has review-worthy risks around persistent setup, broad cleanup deletion, shared temporary memory, and uploading audio to configurable endpoints.
Install only if you are comfortable with a video tool that can download remote media, process local videos, write analysis logs, spawn sub-agents, and optionally upload audio to a configured transcription endpoint. Review .env and proxy settings carefully, avoid running the local Whisper auto-start setup unless you want a background service, and use videoarm-clean cautiously because its deletion scope includes shared OpenClaw temp images.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:22- Finding
Predictable Shared Memory File Allows Agent-State Poisoning
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
videoarm_cli/videoarm_clean.py:48- Finding
Cleanup Command Deletes Images Not Owned by VideoARM
- Content
View full analysis
dict: targets = [] # 1. Temporary processing files processing_dir = Path.home() / ".videoarm" / "video_database" / "temp" / "processing" targets.extend(_collect_files([processing_dir])) # 2. Frame images in workspace tmp workspace_tmp = Path.home() / ".openclaw" / "workspace" / "tmp" targets.extend(_collect_files([workspace_tmp], ["*.jpg", "*.jpeg", "*.png"])) # 3. VideoARM memory file memory_file = Path("/tmp/videoarm_memory.json") if memory_file.exists() and memory_file.is_file(): targets.append(memory_file) # 4. Optional: download cache if include_downloads: downloads_dir = Path.home() / ".videoarm" / "video_database" / "temp" / "downloads" targets.extend(_collect_files([downloads_dir])) # Deduplicate targets = list(dict.fromkeys(targets)) total_size = sum(_file_size(f) for f in targets) deleted = [] errors = [] if not dry_run: for f in targets: try: size = _file_size(f) f.unlink() deleted.append({"path": str(f), "size": size}) except OSError as e: errors.append({"path": str(f), "error": str(e)}) ``` ### Technical Analysis The cleanup command collects all `.jpg`, `.jpeg`, and `.png` files directly under the shared OpenClaw workspace temporary directory. It does not verify that the files were generated by VideoARM. The command performs deletion by default because `dry_run` defaults to `False`. Consequently, invoking `videoarm-clean` can remove images created by unrelated skills, concurrent OpenClaw tasks, or users. File extension alone is not a valid ownership boundary. The implemen ...[truncated 1295 chars]- Remediation
View remediation
/`. 2. Maintain a manifest of files created by each VideoARM session. 3. Delete only files listed in that manifest and verified to be descendants of the VideoARM-owned directory. 4. Resolve and validate each path before deletion to prevent symlink or path-escape behavior. 5. Never use file extensions as proof of file ownership. 6. Make dry-run mode the default when any shared directory is involved. 7. Require an explicit confirmation or force option before destructive cleanup. 8. Add automated tests proving that unrelated files in the OpenClaw workspace remain untouched. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
videoarm_cli/videoarm_audio.py:37- Finding
Unrestricted Transcription Endpoint Can Receive Private Audio and API Credentials
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (86)
Tainted flow: 'proxies' from os.environ.get (line 47, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 92% confidence
- Finding
The code honors HTTPS_PROXY/https_proxy from the environment and may send the Authorization bearer token plus uploaded audio through an attacker-controlled proxy. In a tool that handles potentially sensitive media, this can enable credential capture and interception of transcript content if the runtime environment is untrusted or manipulated.
- Content
python tracer.log("api_call", model=model, base_url=base_url, proxy=bool(proxy)) with open(tmp, "rb") as audio_file: resp = requests.post( f"{base_url}/audio/transcriptions", headers={"Authorization": f"Bearer {api_key}"}, files={"file": ("audio.wav", audio_file, "audio/wav")},
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If you prefer faster transcription or better accuracy, set a cloud API in
.env:bash cp .env.example .env| Option | Setup | Speed |
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill explicitly supports downloading videos from arbitrary URLs via
videoarm-download, which introduces network access, untrusted remote content ingestion, and local storage of externally sourced files. In a media-processing skill this is contextually relevant, but it still expands the attack surface through SSRF-like fetches, malicious media payloads against downstream tools, and unexpected data egress through proxy configuration.- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 77% confidence
- Finding
The code invokes ffmpeg via subprocess, but the declared permissions reportedly do not include shell/process execution. Even without shell=True, undeclared process execution expands the skill's effective privileges and can violate sandboxing or policy assumptions in the hosting platform.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 77% confidence
- Finding
The code invokes ffmpeg via subprocess, but the declared permissions reportedly do not include shell/process execution. Even without shell=True, undeclared process execution expands the skill's effective privileges and can violate sandboxing or policy assumptions in the hosting platform.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 77% confidence
- Finding
The code invokes ffmpeg via subprocess, but the declared permissions reportedly do not include shell/process execution. Even without shell=True, undeclared process execution expands the skill's effective privileges and can violate sandboxing or policy assumptions in the hosting platform.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md def get_config(): """Get configuration from environment variables. Loads .env file automatically. Uses VISION_* vars with OPENAI_* fallback. Supports OpenClaw (default), OpenAI, and Anthropic APIs. """ from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_config(): """Get configuration from environment variables. Loads .env file automatically. Uses VISION_* vars with OPENAI_* fallback. Supports OpenClaw (default), OpenAI, and Anthropic APIs. """ from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_config(): """Get configuration from environment variables. Loads .env file automatically. Uses VISION_* vars with OPENAI_* fallback. Supports OpenClaw (default), OpenAI, and Anthropic APIs. """ from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_config(): """Get configuration from environment variables. Loads .env file automatically. Uses VISION_* vars with OPENAI_* fallback. Supports OpenClaw (default), OpenAI, and Anthropic APIs. """ from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """Analyze frames using Anthropic.""" from anthropic import Anthropic # Get API key from environment (set by OpenAWS) api_key = os.getenv("ANTHROPIC_API_KEY") if not api_key: raise RuntimeError("ANTHROPIC_API_KEY not set. Run from OpenAWS session.")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def update_env(): """Update .env with local whisper config.""" env_path = Path(__file__).parent.parent / ".env" config = { "WHISPER_API_KEY": "local",
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script installs and loads a macOS launch agent so the Whisper service starts automatically on login/boot, which is a persistence mechanism. In the context of a transcription helper, persistence is not strictly necessary to answer video questions and therefore creates disproportionate risk if the service, plist, or dependent code is later modified or abused.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 94% confidence
- Finding
The script invokes a shell via os.system() to load a launchd agent, which is an unsafe execution primitive and also activates persistent background execution on the host. Even though plist_dst is locally constructed, shell-based execution increases risk if the path or environment is manipulated, and the more significant danger is the unprompted loading of a persistent service during setup.
- Content
python import shutil plist_dst.parent.mkdir(parents=True, exist_ok=True) shutil.copy2(plist_src, plist_dst) os.system(f"launchctl load {plist_dst}") print(f"✅ Installed launchd service: {plist_dst}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file applies to SQP-2, and it describes behaviors that affect user data and system state: downloading remote videos, processing local videos, extracting frames/transcripts, and later creating a marker file. The document explains functionality but does not include any explicit warning about network access, handling of local media content, or creation of files on disk.
- Content
Static analysis
No suspicious patterns detected.