Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only video generation skill that clearly centers on using Volcengine's API, with no hidden executable code or persistence behavior found.
Before installing, users should understand that prompts, any referenced media, task metadata, and generated content may be sent to and processed by Volcengine. Avoid using confidential, regulated, or personal material unless that third-party processing is acceptable, and protect the configured API credentials.
The README shows direct API usage with a bearer token and sends user-supplied prompt content to a third-party service, but it does not clearly warn about external data transmission or privacy implications. Users may unknowingly submit sensitive prompts, images, or metadata to an external provider under the skill's workflow.
The documented POST request explicitly transmits user content and an authorization bearer token to an external service endpoint. In the context of an agent skill, this is security-relevant because users may not realize their prompts or referenced media are leaving the local environment, creating privacy, compliance, and data-handling risks.
# 生成视频
curl -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${API_KEY}" \
-d '{
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## 详细文档
查看完整文档：`~/.openclaw/skills/jimeng-video/SKILL.md`
The skill documentation explicitly describes sending user-provided prompts and potentially uploaded images to a third-party service, but it does not clearly warn users that their content will leave the local environment and be processed by Volcengine. This is dangerous because users may unknowingly submit sensitive text or media, creating privacy, confidentiality, or compliance risks.
The documented curl example shows direct transmission of user content to an external API endpoint, confirming that prompts are sent off-platform for processing. While expected for a video-generation integration, it is still security-relevant because any sensitive or regulated content entered by users may be exposed to a third party without adequate disclosure or controls.
curl -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${API_KEY}" \
-d '{
All natural-language instructions and examples in the README are presented only in Chinese, which effectively forces a specific language for users reading the skill documentation. The file does not offer an alternative language, opt-in, or justification that the skill is intended solely for a Chinese-language or region-specific audience.
No suspicious patterns detected.