ClawHub
Back to skill

Security audit

视频反向提示

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently uploads user-selected videos or video URLs to NanoPhoto.AI for reverse-prompt analysis, with some privacy and credential-handling cautions but no hidden or destructive behavior found.

Use this skill only for videos or URLs you are allowed to send to NanoPhoto.AI. Configure NANOPHOTO_API_KEY through the platform or environment, avoid the --api-key command-line option, and do not submit confidential media unless you accept the third-party processing and credit cost.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/reverse_prompt_file.py:25
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/reverse_prompt_file.py:37
Finding

Extension-Only Validation Allows Arbitrary Local File Upload

Content
View full analysis
MAX_FILE_BYTES: fail(f"File too large: {size} bytes (> {MAX_FILE_BYTES} bytes / 30 MB limit)") video_base64 = base64.b64encode(path.read_bytes()).decode("ascii") payload = { "videoSource": "file", "locale": args.locale, "videoFile": video_base64, "videoFileName": path.name, } body = json.dumps(payload).encode("utf-8") request = urllib.request.Request( API_URL, data=body, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", "Accept": "text/plain, */*", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8", "Origin": "https://nanophoto.ai", "Referer": "https://nanophoto.ai/", }, method="POST", ) ``` ### Technical Analysis The helper determines whether a local file is an MP4 solely from its filename suffix. It does not inspect the file header, validate the ISO Base Media File Format structure, or use a media parser to confirm that the content is a valid video. Consequently, any readable file renamed with an `.mp4` suffix can pass validation. The complete file is then read, Base64-encoded, inserted into a JSON request, and transmitted to the declared NanoPhoto.AI endpoint. Base64 encoding itself is not covert behavior in this context: it is documented and required by the API format. Network transmission is also necessary for the Skill's declared cloud-analy ...[truncated 1386 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code generally aligns with the NanoPhoto reverse-prompt purpose and uses the stated API key mechanism, but it materially underimplements the declared input support. The description says the skill supports YouTube links, direct MP4 URLs, and local MP4 upload; this script only validates and uploads a local .mp4 file. It also does not itself implement shot-by-shot breakdown or storyboard extraction logic beyond relaying the API response. That makes the description broader than the actual behavior in this code chunk, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents behaviors that require network access and local file reading, but it does not declare any explicit tool scope such as allowed-tools or permissions. That weakens containment and reviewability, because consumers cannot easily tell what capabilities the skill is expected to use before execution.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: video-reverse-prompt
description: "Analyze videos to extract reverse prompts, shot-by-shot breakdowns, and AI-ready visual descriptions via the NanoPhoto.AI Video Reverse Prompt API. Use when: (1) User wants reverse prompt, prompt extraction, or video-to-prompt analysis, (2) User provides a YouTube link, direct MP4 URL, or local MP4 file and wants a shot list / storyboard-style breakdown, (3) User mentions video analysis, shot breakdown, extract prompt from video, NanoPhoto, or reverse engineer a video prompt. Supports YouTube links, direct .mp4 URLs, and local file upload. Prerequisite: Obtain an API key at https://nanophoto.ai/settings/apikeys and configure env.NANOPHOTO_API_KEY."
homepage: https://nanophoto.ai
metadata: {"openclaw":{"homepage":"https://nanophoto.ai","requires":{"env":["NANOPHOTO_API_KEY"]},"primaryEnv":"NANOPHOTO_API_KEY"}}
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description does not prominently warn users that provided video URLs or local video files are transmitted to a third-party service for processing. This can cause users to disclose sensitive or copyrighted content without informed consent, especially because local file upload is a core workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This skill sends user-supplied video content or URLs, along with an API credential, to an external third-party endpoint. External transmission is expected for the feature, but it is still security-relevant because sensitive media may leave the local environment and be processed off-platform.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

YouTube Video

bash
curl -X POST "https://nanophoto.ai/api/sora-2/reverse-prompt" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NANOPHOTO_API_KEY" \
  --data-raw '{

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
# Video Reverse Prompt API Reference

## Endpoint

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# Video Reverse Prompt API Reference

## Endpoint

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/api.md (reported line 1)May include surrounding context.

md
# Video Reverse Prompt API Reference

## Endpoint

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · scripts/reverse_prompt_file.py (reported line 22)May include surrounding context.

python
# Video Reverse Prompt API Reference

## Endpoint

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reference documents uploading local videos and remote URLs to a third-party API but does not explicitly warn users that their video content will be transmitted off-platform for processing. This creates a real privacy and data-handling risk because users may submit sensitive or proprietary media without informed consent, especially in an agent skill context where the transfer may feel implicit.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The example performs an authenticated POST request containing video data to an external service, which is expected functionality for this skill but still represents real external data exfiltration from the local environment to a third party. In this skill context, the danger is moderated because the transfer is aligned with the advertised purpose, but it remains security-relevant when local files or confidential media are involved.

Content

Scanner excerpt · references/api.md (reported line 90)May include surrounding context.

md
const videoBuffer = await readFile("your-video.mp4");
const videoBase64 = videoBuffer.toString("base64");

const response = await fetch("https://nanophoto.ai/api/sora-2/reverse-prompt", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/reverse_prompt_file.py (reported line 31)May include surrounding context.

python
parser.add_argument("--retry-delay", type=float, default=3.0, help="Initial retry delay in seconds; doubles after each attempt (default: 3.0)")
    args = parser.parse_args()

    api_key = args.api_key or __import__("os").environ.get("NANOPHOTO_API_KEY")
    if not api_key:
        fail("Missing API key. Set NANOPHOTO_API_KEY or pass --api-key.")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script base64-encodes the entire local MP4 and sends it, along with the original filename, to a third-party remote API. In a skill context, this creates a real data-exfiltration/privacy risk because users may provide sensitive local media, and the code does not present a clear, explicit transmission warning, consent gate, or filename minimization before upload.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script lets the user choose an output locale, but the HTTP header still forces 'zh-CN,zh;q=0.9,en;q=0.8' for every request. This is a natural-language/locale policy issue because it silently applies a specific language preference that the user did not select.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.