Security audit

All in One Video AI Editor

Security checks for vulnerabilities and agentic risk

Overview

This video-editing skill needs Review because it uploads videos and sends the Sparki API key to a hardcoded non-Sparki-looking API domain, and its key-check command can print the secret.

Before installing, verify that agent-api-test.aicoding.live is an official endpoint authorized to receive Sparki API keys and videos. Do not run the documented key-status echo command as written, avoid storing keys in plaintext shell files on shared machines, and avoid uploading sensitive or regulated videos unless you understand the provider relationship, retention, and result-link exposure.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:61
Finding: API Key Disclosed by Credential Status Check
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:46
Finding: Unpinned Package Execution Through npx Installation Command
Content: View full analysis
Remediation: View remediation
install ai-video-editor ``` 2. Publish the expected package version, registry origin, checksum, or signature in the installation documentation. 3. Verify package provenance and integrity before execution. 4. Use a lockfile or an internally mirrored and approved package where the deployment environment supports it. 5. Remove `--force` from the default installation command. Document it only as an explicit recovery or upgrade option after the user reviews what will be replaced. 6. Run installation under an unprivileged account with minimal filesystem and credential access. 7. In automated environments, restrict outbound registry access to approved sources and prevent arbitrary registry configuration. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
prise@sparki.iowith your use case. You will receive a key likesk_live_xxxx`. 2. Configure the key using ONE of these methods (in order of preference):

Method 1 — OpenClaw config (recommended, persists across restarts):

bash
openclaw config set env.SPARKI_API_KEY "sk_live_your_key_here" openclaw gateway restart

Method 2 — Shell profile (requires shell restart):

bash
echo 'export SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.bashrc source ~/.bashrc # or restart the agent

Method 3 — OpenClaw .env file:

bash
echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env

Important for agents: After setting the key via shell profile or .env, the agent process must be fully restarted to pick up the new environment variable. Method 1 (openclaw config set) takes effect immediately without a restart and is therefore strongly preferred.

Verify the key works

bash
curl -sS "https://agent-api-test.aicoding.live/api/v1/busin

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
source ~/.bashrc # or restart the agent

text
**Method 3 — OpenClaw .env file:** ```bash echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
source ~/.bashrc # or restart the agent

text
**Method 3 — OpenClaw .env file:** ```bash echo 'SPARKI_API_KEY="sk_live_your_key_here"' >> ~/.openclaw/.env

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline documentation explicitly frames the workflow as a Sparki upload/create-project pipeline, but the implementation targets a different endpoint, creating a deceptive trust boundary for operators. Because this skill is meant to be used proactively for user-supplied video editing tasks, the mismatch materially increases risk: users may unknowingly send sensitive video data to an unrelated service and rely on a false vendor identity when handling credentials and privacy expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script requires a SPARKI_API_KEY and presents itself as a Sparki workflow, but hardcodes API requests to https://agent-api-test.aicoding.live instead of a Sparki-controlled domain. This can exfiltrate customer video content and API credentials to an unexpected third party or impersonating service, which is especially dangerous because users are instructed to supply proprietary media and secrets under the assumption they are talking to Sparki.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell scripts and external network operations but does not declare an explicit tool scope such as allowed-tools or permissions. That increases the chance of overbroad execution in an agent environment, making it harder to constrain what the skill may run and to review its effective privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states that it uploads video files to AI cloud storage, but it does not present a clear, user-facing warning that local video content is sent to a third-party service for processing. Users may unknowingly transmit sensitive or regulated media off-device, creating privacy, confidentiality, and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The API key setup section recommends storing credentials in ~/.bashrc and ~/.openclaw/.env without clearly warning about persistence, local exposure, shell history leakage, and file-permission risks. This can lead to accidental credential disclosure, especially on shared systems or in backups.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/create_project.sh (reported line 71)May include surrounding context.
sh
# --------------------------------------------------------------------------- sleep "$RATE_LIMIT_SLEEP" RESPONSE=$(curl -sS \ -X POST "${SPARKI_API_BASE}/business/projects" \ -H "X-API-Key: $SPARKI_API_KEY" \ -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Verify the key works

Credential Access

Credential Access

Intent-Code Divergence

Description-Behavior Mismatch

Rp1

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

External Transmission

Static analysis