ClawHub
Back to skill

Security audit

Media Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This media skill mostly matches its stated purpose, but it uses broad execution and messaging authority in ways that need review before installation.

Review this skill before installing. It can execute local commands, download media, write files into the OpenClaw workspace, and send files or messages through configured WhatsApp or Telegram accounts. Installation is most appropriate only in an environment where the spotify-surface dependency is trusted and pinned, outbound recipients are controlled, and workspace file retention is acceptable.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/orchestrator.py:22
Finding

Execution of an Unverified External Workspace Script

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/orchestrator.py:101
Finding

Caller-Controlled Messaging Destination Lacks Authorization Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description understates several sensitive behaviors: outbound file delivery to external chat platforms, delegation to other local scripts, fixed-path workspace access, and execution of local/system binaries. This mismatch is dangerous because users and security controls may approve the skill for simple media handling while it actually performs broader data movement and code execution operations that materially expand the attack surface.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises operational behavior that inherently requires network and shell-like execution capabilities, but it does not declare any tool scope or permissions boundaries. This is dangerous because it obscures the true execution surface from reviewers and enforcement systems, increasing the chance that a media request triggers undeclared downloads, command execution, or file handling without explicit authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that media is downloaded into the workspace and then dispatched to WhatsApp or Telegram, but it omits a clear user warning that local files will be created and transmitted off-platform. This is dangerous because users may not realize their requested content, metadata, or adjacent workspace artifacts could be retained temporarily and sent to third-party services, creating privacy, compliance, and data leakage risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest grants exec plus filesystem read/write permissions and explicitly describes downloading and delivering media, which are impactful operations that can create, modify, and exfiltrate files or invoke external tools. Without a clear user-facing warning or consent language, users may not understand that the skill can execute binaries and write downloaded content to disk, increasing the risk of misuse or unintended system changes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/orchestrator.py (reported line 16)May include surrounding context.

python
workspace = Path("/home/ky11rie/.openclaw/workspace")

    # Check for ffmpeg
    has_ffmpeg = subprocess.run(["which", "ffmpeg"], capture_output=True).returncode == 0
    if not has_ffmpeg:
        log_output("ffmpeg/ffprobe not found. Using fallback formats (m4a/mp4 direct).")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/orchestrator.py (reported line 29)May include surrounding context.

python
# Determine source based on chat_target (WhatsApp or Telegram)
            source = "whatsapp" if chat_target and chat_target.startswith("+") else "telegram"
            cmd = ["python3", str(spotify_script_path), source, query]
            spotify_result = subprocess.run(cmd, capture_output=True, text=True, check=True)
            log_output(f"Spotify Surface output: {spotify_result.stdout}")
            # spotify_surface script already handles output emission
            return

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill downloads media from external sources and immediately transmits it to a chat target without any user-facing confirmation, warning, or explicit authorization check in this file. In an agent context, that enables unintended outbound messaging, content relay, and possible policy or privacy violations if a prompt or tool call is manipulated to send media to arbitrary recipients.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/orchestrator.py (reported line 79)May include surrounding context.

python
log_output(f"Executing yt-dlp: {' '.join(yt_dlp_command)}")

    try:
        subprocess.run(yt_dlp_command, check=True)
        if download_path.exists():
            message_user(chat_target, None, is_whatsapp=chat_target.startswith("+"), file_path=str(download_path))
            log_output(f"Successfully sent {download_filename} to {chat_target}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/orchestrator.py (reported line 112)May include surrounding context.

python
return

    try:
        subprocess.run(cmd_prefix, check=True)
    except Exception as e:
        log_output(f"Failed to send message/file to user: {e}")

Static analysis

No suspicious patterns detected.