ClawHub
Back to skill

Security audit

Video Clip

Security checks for vulnerabilities and agentic risk

Overview

The local clipping tool is narrow, but the same skill also documents cloud video upload and has unsafe API-key handling that users should review before installing.

Install only after reviewing the AI Edit section carefully. The local clip script is straightforward, but avoid using the AI Edit commands for private, confidential, copyrighted, or regulated videos unless you are comfortable sending the full file and API key to the listed remote service. Do not run the shown key-check command as written; it can print your API key.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:83
Finding

API Key Disclosed by Configuration Status Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:83-85
Vulnerability Type: Credential exposure through unsafe shell parameter expansion
Risk Level: High

Vulnerable Code:

bash
# Check if key is configured
echo "Key: ${SPARKI_API_KEY:+configured}${SPARKI_API_KEY:-MISSING}"

Technical Analysis

The command is presented as a status check, but it prints the actual API key whenever SPARKI_API_KEY is set. The first expansion, ${SPARKI_API_KEY:+configured}, produces the word configured, while the second expansion, ${SPARKI_API_KEY:-MISSING}, produces the secret value. These results are concatenated.

For example, if the environment contains SPARKI_API_KEY=sk_live_secret, the command prints:

text
Key: configuredsk_live_secret

This exposes a credential in standard output rather than merely reporting whether it is configured.

Attack Path

  1. A user configures SPARKI_API_KEY as instructed by the skill.
  2. The prerequisite status command is executed.
  3. The shell expands the environment variable to its complete secret value.
  4. The secret is written to terminal output.
  5. The credential may be captured by an agent transcript, shell log, CI log, terminal recording, monitoring system, or another party with access to command output.
  6. An attacker who obtains the key may submit authenticated requests to the associated service, subject to the permissions assigned to that key.

Impact Assessment

The vulnerability directly compromises the confidentiality of SPARKI_API_KEY. An attacker could obtain the same service-level privileges granted to the exposed key, potentially including media uploads, project creation, project-status access, and consumption of account resources. The precise scope depends on server-side permissions and account controls. This issue does not by itself grant local operating-system privileges.

Remediation
View remediation

Remediation Suggestions

Replace the unsafe expansion with a status-only conditional that never interpolates the credential into output:

bash
if [[ -n "${SPARKI_API_KEY:-}" ]]; then
  echo "Key: configured"
else
  echo "Key: MISSING"
fi

Additional hardening measures:

  • Never print, trace, or log API keys, including during diagnostic operations.
  • Disable shell tracing before handling credentials and ensure callers do not invoke the workflow with set -x.
  • Redact authorization headers and environment variables from agent transcripts and CI logs.
  • Rotate any credential that may already have been exposed by this command.
  • Restrict API keys to the minimum required permissions and apply expiration, quotas, and server-side audit logging.

other

Warning
Location
SKILL.md:105
Finding

Potentially Sensitive Videos Uploaded to an External Test-Domain Service Without an Explicit Consent Gate

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:105-119
Vulnerability Type: Sensitive data disclosure to a third-party service
Risk Level: Medium

Vulnerable Code:

bash
SPARKI_API_BASE="https://agent-api-test.aicoding.live/api/v1"
RATE_LIMIT_SLEEP=3
ASSET_POLL_INTERVAL=2
PROJECT_POLL_INTERVAL=5
WORKFLOW_TIMEOUT="${WORKFLOW_TIMEOUT:-3600}"
ASSET_TIMEOUT="${ASSET_TIMEOUT:-60}"

: "${SPARKI_API_KEY:?Error: SPARKI_API_KEY is required. Run: openclaw config set env.SPARKI_API_KEY <key>}"

FILE_PATH="$1"; TIPS="$2"; USER_PROMPT="${3:-}"; ASPECT_RATIO="${4:-9:16}"; DURATION="${5:-}"

# -- Step 1: Upload --
echo "[1/4] Uploading $FILE_PATH..." >&2
UPLOAD_RESP=$(curl -sS -X POST "${SPARKI_API_BASE}/business/assets/upload" \
  -H "X-API-Key: $SPARKI_API_KEY" -F "file=@${FILE_PATH}")

Technical Analysis

The primary skill is described as local video clipping, but its AI-edit escalation workflow uploads the complete file selected by FILE_PATH to https://agent-api-test.aicoding.live. This hostname differs from the advertised sparki.io homepage and explicitly appears to be a test endpoint.

The documentation describes the upload step, so the network transfer is not hidden in code. However, the workflow does not implement an explicit informed-consent gate before transmitting the file, and it does not state retention, access, deletion, geographic-processing, or privacy terms. A user who relies on the prominent local-processing description could therefore submit private media without fully understanding that the AI workflow has materially different data-handling behavior.

The X-API-Key header also sends the configured credential to this external host. HTTPS protects data in transit against ordinary passive interception, but the endpoint itself receives both the media and credential.

Attack Path

  1. A user provides a local video containing private, confidential, regulated, or proprietary ma ...[truncated 1089 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit confirmation immediately before upload, naming the destination hostname and the exact local file that will be transmitted.
  • Clearly separate the local FFmpeg workflow from cloud-based AI processing in the top-level skill description.
  • State what data is uploaded, why it is needed, how long it is retained, who can access it, where it is processed, and how users can request deletion.
  • Replace the test-domain endpoint with a verified production endpoint under a documented vendor-controlled domain.
  • Validate the destination against a strict HTTPS hostname allowlist and do not permit environment variables or user input to redirect credential-bearing requests to arbitrary hosts.
  • Provide a preview of the file path and size and allow the user to cancel before transmission.
  • Apply least-privilege, short-lived API credentials and avoid reusing credentials across test and production environments.
  • Offer redaction, local preprocessing, or reduced-resolution uploads where full source media is unnecessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is presented as a local ffmpeg-based clipping tool, but the documentation embeds a separate remote AI editing workflow that uploads user videos and submits processing jobs to an external service. This materially expands the skill’s capabilities and trust boundary beyond the manifest’s stated purpose, creating a deceptive or at least under-disclosed path for data exfiltration and remote processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented AI Edit flow uploads the user's video to a remote API and polls remote endpoints, even though the skill’s stated purpose is simple local clipping. For a media file workflow, this is dangerous because videos often contain sensitive personal, corporate, or copyrighted content, and the remote upload capability is not justified by the core local functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown instructs the operator to upload the user’s video to an external API but does not prominently warn that the media leaves the local machine, may be retained remotely, and may be subject to third-party handling. This omission undermines informed consent and can cause unintentional disclosure of sensitive video content and related metadata.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The curl POST to the external projects endpoint is a real external transmission primitive that sends editing parameters and references to uploaded media to a remote service. In isolation this can be legitimate, but in this skill context it is security-relevant because it operationalizes off-device processing not clearly aligned with the local-only positioning of the skill.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
'{object_keys:$k,tips:$t,aspect_ratio:$a}
   | if $p != "" then .+{user_prompt:$p} else . end
   | if $d != "" then .+{duration:($d|tonumber)} else . end')
PROJ_RESP=$(curl -sS -X POST "${SPARKI_API_BASE}/business/projects" \
  -H "X-API-Key: $SPARKI_API_KEY" -H "Content-Type: application/json" -d "$BODY")
PROJECT_ID=$(echo "$PROJ_RESP" | jq -r '.data.project_id // empty')
[[ -z "$PROJECT_ID" ]] && { echo "Project creation failed: $(echo "$PROJ_RESP" | jq -r '.message')" >&2; exit 1; }

Static analysis

No suspicious patterns detected.