T08 · Insecure Dependencies
Warning
- Location
SKILL.md:10- Finding
Unpinned and Inconsistent npm Package Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Messages from your openclaw
Security checks for vulnerabilities and agentic risk
Overview
The skill's main video-message workflow is coherent, but its installer points to inconsistent global npm packages and it includes an overbroad temp-file deletion command.
Review the npm package identity before installing and prefer a pinned, verified package. Use this skill only when you intend generated audio/video content and configured avatar/background assets to be sent through Telegram, and replace the wildcard cleanup command with deletion of the exact output file for the current run.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
The cleanup command uses a wildcard deletion in /tmp, which is risky because it may remove files beyond the exact artifact produced by the current run if naming collisions or symlink-related edge cases exist. In an agent context, broad shell cleanup patterns are dangerous because they normalize destructive file operations without strict binding to known-safe paths.
- Content
md ## Notes - Config is read from TOOLS.md - Clean up temp files after sending: `rm /tmp/video*.mp4` - For regular video (not circular), omit `asVideoNote=true`
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description is broad enough to activate on common requests involving video replies or converting TTS delivery format, which can cause the skill to run in situations the user did not clearly intend. In this skill, unintended activation matters because the workflow can generate media and send it externally via Telegram, increasing the chance of surprise actions and privacy-impacting behavior.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Platform | Command | |----------|---------| | **macOS** | `brew install ffmpeg` | | **Linux** | `sudo apt-get install -y xvfb xauth ffmpeg` | | **Windows** | Install ffmpeg and add to PATH | | **Docker** | See Docker section below |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to send generated media through Telegram but does not require explicit disclosure or confirmation that content will be transmitted to an external service. This creates a privacy and consent risk, especially if the generated video contains user-provided text, voice content, or avatar/media derived from local configuration.
- Content
Static analysis
No suspicious patterns detected.