TSW Shorts Factory

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This skill matches its video-automation purpose, but it contains under-disclosed high-impact upload behavior and unsafe implementation choices that users should review before installing.

Review this skill before installing. It automates YouTube uploads and uses persistent OAuth access, so run it only in a contained account. Do not rely on its draft/unlisted claim unless the missing uploader script is supplied and audited. Rotate the exposed Pexels key, replace pickle token storage, remove hard-coded /root paths and external sys.path injection, and pin dependencies before production use.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/pipeline.py:18

Finding

Execution of an Unpackaged and Unaudited External Uploader

Content

View full analysis

Vulnerability Details

File Location: scripts/pipeline.py, lines 18–23 and 245–260
Vulnerability Type: External tool hijacking through hard-coded mutable paths
Risk Level: High

Vulnerable Code

python

sys.path.insert(0, '/root/.openclaw/workspace/projects/content/vanyan_video_factory')

# ── Config ──────────────────────────────────────────────────────────────────
QUOTE_LIBRARY   = "/root/.openclaw/workspace/projects/content/tsw_quote_library.json"
OUTPUT_DIR      = "/root/tsw_videos/noltx_output"
AUDIO_DIR       = "/root/tsw_videos/noltx_audio"
CLIP_CACHE_DIR  = "/root/tsw_videos/clip_library"
LOG_FILE        = "/root/.openclaw/workspace/agents/tsw/cron.log"
YT_UPLOADER     = "/root/.openclaw/workspace/projects/content/yt_uploader.py"

python

def upload_to_youtube(video_path, title, description):
    try:
        result = subprocess.run(
            ["python3", YT_UPLOADER, video_path, title, description],
            capture_output=True, text=True, timeout=300
        )
        if result.returncode == 0:
            log.info(f"YouTube upload: {result.stdout.strip()[:200]}")
            return True
        else:
            log.warning(f"YouTube upload failed: {result.stderr.strip()[:200]}")
            return False
    except Exception as e:
        log.error(f"Upload error: {e}")
        return False

Technical Analysis

The pipeline executes yt_uploader.py from a hard-coded path outside the audited project. That uploader is not included in the supplied directory, so its behavior, credential handling, network destinations, and YouTube privacy configuration cannot be verified.

The script also prepends an external directory to sys.path. Because the directory is placed first in Python's module search order, a malicious module placed there could shadow imported packages such as requests, edge_tts, or moviepy.

Although the subprocess call uses an argument list and is not directly vulnerable to shell inje ...[truncated 1074 chars]

Remediation

View remediation

Remediation Suggestions

• Package the uploader inside the audited project and review it together with the pipeline.
• Remove the external sys.path.insert operation and use normal package imports.
• Resolve project resources relative to Path(__file__) rather than hard-coded workspace paths.
• If an external executable is unavoidable, configure its path explicitly, verify its ownership and permissions, and validate it against a trusted cryptographic hash before execution.
• Run the pipeline as a dedicated, unprivileged service account rather than root.
• Implement YouTube uploading directly through the reviewed Google API client and explicitly set and verify the intended privacy status.
• Restrict write access to all executable code and dependency directories.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pipeline.py:24

Finding

Hard-Coded Pexels API Credential in Source Code

Content

View full analysis

Vulnerability Details

File Location: scripts/pipeline.py, lines 24 and 113–119
Vulnerability Type: Embedded plaintext API credential
Risk Level: High

Vulnerable Code

python

PEXELS_KEY      = "z4qzlGqn6cZzDpEzt6vsrLfxPXXVrGfDRJ7n3bB7xReXA53drnG0b3BD"

python

r = requests.get("https://api.pexels.com/videos/search",
    headers={"Authorization": PEXELS_KEY},
    params={"query": query, "per_page": count + 2,
            "orientation": "portrait", "size": "medium"},
    timeout=15)

Technical Analysis

A Pexels API key is embedded directly in the distributed Python source. Anyone who can download or inspect the project can recover and reuse the credential. This contradicts SKILL.md, which instructs users to provide PEXELS_API_KEY through the environment; the implementation never reads that variable.

Source-code credentials are difficult to rotate safely and may remain recoverable from package copies, logs, caches, forks, or repository history even after removal from the current version.

Attack Path

1. An attacker obtains a copy of the project or views its source.
2. The attacker extracts the plaintext value assigned to PEXELS_KEY.
3. The attacker sends requests to the Pexels API using the key in the Authorization header.
4. Requests consume the credential owner's quota and are attributed to that account until the key is revoked.

Impact Assessment

The exposed credential can be used for unauthorized Pexels API access within the permissions assigned to the key. Likely consequences include quota exhaustion, service interruption, account attribution issues, and possible account suspension for abusive traffic. This credential does not by itself provide operating-system or YouTube account access.

Remediation

View remediation

Remediation Suggestions

• Immediately revoke and rotate the exposed Pexels key.
• Remove the credential from source code and repository history.
• Load it from the documented environment variable:

python

PEXELS_KEY = os.environ.get("PEXELS_API_KEY")
if not PEXELS_KEY:
    raise RuntimeError("PEXELS_API_KEY is required")

• Use a secret manager for automated deployments and restrict secret access to the dedicated runtime account.
• Add secret-scanning checks to CI and pre-commit workflows.
• Avoid logging credentials or complete authorization headers.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/yt_setup.py:15

Finding

Unsafe Deserialization of YouTube OAuth Credentials with Pickle

Content

View full analysis

Vulnerability Details

File Location: scripts/yt_setup.py, lines 15–19
Vulnerability Type: Arbitrary code execution through unsafe deserialization
Risk Level: High

Vulnerable Code

python

def setup():
    creds = None
    if os.path.exists(TOKEN_FILE):
        with open(TOKEN_FILE, 'rb') as f:
            creds = pickle.load(f)

Technical Analysis

Python pickle is an executable serialization format. Loading a pickle can invoke attacker-selected Python callables through reduction methods; therefore, pickle.load() must not be used on data whose integrity cannot be guaranteed.

The token is read from the predictable path ~/.yt_token.pickle without checking file ownership, permissions, file type, or integrity. A malicious token file placed or replaced at that location can execute code before credential validity is checked.

Attack Path

1. An attacker or compromised process writes a crafted pickle payload to ~/.yt_token.pickle.
2. The operator runs python3 scripts/yt_setup.py.
3. pickle.load(f) deserializes the crafted object.
4. The payload's reduction callable executes with the privileges of the operator.
5. The payload can access credentials and other resources available to that account.

Impact Assessment

Exploitation permits arbitrary Python code execution under the account running the setup script. If setup is run as root, this can result in full host compromise. Otherwise, the attacker can access or modify files, environment variables, OAuth credentials, and processes available to the affected user. The issue requires an attacker to create or replace the token file, such as through another compromised process, an unsafe shared home directory, or insecure file permissions.

Remediation

View remediation

Remediation Suggestions

• Replace pickle persistence with a non-executable format supported by Google credentials, such as JSON serialization.
• Create credential files with mode 0600 and verify that the file is owned by the current user before reading it.
• Reject symbolic links and non-regular files when opening the token.
• Store OAuth material in an operating-system credential store or managed secret store where practical.
• If migration from the existing pickle is necessary, treat the old file as trusted only after an explicit ownership and permission check, then delete it after conversion.
• Run authentication setup as a dedicated, unprivileged account.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependencies Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16
Vulnerability Type: Non-reproducible and integrity-unverified dependency installation
Risk Level: Medium

Vulnerable Code

bash

# 1. Install dependencies
pip install moviepy edge-tts google-api-python-client google-auth-oauthlib pillow

Technical Analysis

The deployment instructions install third-party packages without exact versions, hashes, or a lock file. Consequently, installations performed at different times may resolve to different package and transitive-dependency versions.

Python package installation can execute package build hooks. If a dependency account, package release, or transitive dependency is compromised, following the documented command can install and execute attacker-controlled code. The absence of version constraints also increases the likelihood of incompatible or newly vulnerable releases being introduced without review.

No evidence shows that the listed package names are themselves malicious; the confirmed issue is the unsafe, non-reproducible dependency-management practice.

Attack Path

1. A listed package or one of its transitive dependencies publishes a compromised release, or an upstream distribution channel is compromised.
2. An operator follows the documented unpinned pip install command.
3. Pip resolves the compromised version because no approved version or hash is enforced.
4. Malicious installation hooks or imported runtime code execute under the operator's account.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges used for installation or pipeline execution. This could expose local files, OAuth credentials, API keys, and generated media. The practical likelihood depends on an upstream supply-chain compromise, but the impact can include full compromise of the runtime account.

Remediation

View remediation

Remediation Suggestions

• Provide a reviewed dependency lock file containing exact versions.
• Generate and enforce cryptographic package hashes, for example with pip install --require-hashes -r requirements.txt.
• Pin transitive dependencies in addition to direct dependencies.
• Install dependencies inside an isolated virtual environment under an unprivileged account.
• Use a trusted internal package mirror where appropriate.
• Enable automated dependency vulnerability scanning and controlled update review.
• Document supported Python and FFmpeg versions to make deployments reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior claims the pipeline uses configured credentials and uploads videos as drafts, but the finding indicates undeclared credential use and delegation to an external uploader script whose actual behavior is not established here. This mismatch is dangerous because reviewers and users cannot reliably determine what data is accessed, which credentials are used, or whether uploads are really restricted to draft/unlisted states.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/youtube-setup.md (reported line 8)May include surrounding context.

md

1. Go to [Google Cloud Console](https://console.cloud.google.com/)
2. Create project → Enable **YouTube Data API v3**
3. Create credentials → **OAuth 2.0 Client ID** → Desktop app
4. Download JSON → rename to `yt_client_secrets.json` in working dir
5. Run: `python3 scripts/yt_setup.py` (opens browser for auth)
6. Token saved to `~/.yt_token.pickle` — valid until revoked

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yt_setup.py (reported line 12)May include surrounding context.

python

1. Go to [Google Cloud Console](https://console.cloud.google.com/)
2. Create project → Enable **YouTube Data API v3**
3. Create credentials → **OAuth 2.0 Client ID** → Desktop app
4. Download JSON → rename to `yt_client_secrets.json` in working dir
5. Run: `python3 scripts/yt_setup.py` (opens browser for auth)
6. Token saved to `~/.yt_token.pickle` — valid until revoked

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yt_setup.py (reported line 33)May include surrounding context.

python

1. Go to [Google Cloud Console](https://console.cloud.google.com/)
2. Create project → Enable **YouTube Data API v3**
3. Create credentials → **OAuth 2.0 Client ID** → Desktop app
4. Download JSON → rename to `yt_client_secrets.json` in working dir
5. Run: `python3 scripts/yt_setup.py` (opens browser for auth)
6. Token saved to `~/.yt_token.pickle` — valid until revoked

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/youtube-setup.md (reported line 15)May include surrounding context.

Token Refresh

Tokens auto-refresh. If auth breaks after 6+ months:

bash

rm ~/.yt_token.pickle
python3 scripts/yt_setup.py

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises operational behavior that clearly requires file access, network access, and shell execution, but it does not declare any tool scope or permissions boundary. This is dangerous because an agent may invoke the skill with broader ambient privileges than intended, making external network calls, reading local files, or executing commands without explicit user-visible authorization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Because this is a markdown file, vague-trigger review applies. The description lists broad activation conditions such as 'building faceless quote/motivation channels' and 'automating social video content at scale' without clear constraints, negative examples, or a bounded trigger list, which can cause unintended invocation for generic social-media automation requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/youtube-setup.md (reported line 6)May include surrounding context.

md

## One-Time Setup

1. Go to [Google Cloud Console](https://console.cloud.google.com/)
2. Create project → Enable **YouTube Data API v3**
3. Create credentials → **OAuth 2.0 Client ID** → Desktop app
4. Download JSON → rename to `yt_client_secrets.json` in working dir
5. Run: `python3 scripts/yt_setup.py` (opens browser for auth)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The TTS generation hard-codes the voice to "en-US-GuyNeural", which enforces a specific language and locale for all output. This is a natural-language policy concern because the skill does not provide any user choice, opt-in, or documented justification for the locale restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The pipeline sends requests to an external service and embeds a hardcoded Pexels API key in source, creating credential exposure and uncontrolled third-party transmission. In this autonomous content-generation context, the skill routinely reaches out to external infrastructure, so leaked credentials and unsupervised data egress are more consequential than in a purely local tool.

Content

Scanner excerpt · scripts/pipeline.py (reported line 111)May include surrounding context.

python

# Fetch from Pexels
    try:
        r = requests.get("https://api.pexels.com/videos/search",
            headers={"Authorization": PEXELS_KEY},
            params={"query": query, "per_page": count + 2,
                    "orientation": "portrait", "size": "medium"},

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pipeline.py (reported line 234)May include surrounding context.

python

# ── Stage 5: Upload to YouTube ───────────────────────────────────────────────
def upload_to_youtube(video_path, title, description):
    try:
        result = subprocess.run(
            ["python3", YT_UPLOADER, video_path, title, description],
            capture_output=True, text=True, timeout=300
        )

Insecure deserialization: pickle.load()

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The script deserializes ~/.yt_token.pickle using pickle.load(), which can execute arbitrary code if that file is replaced or tampered with. Although this is intended for storing OAuth credentials, pickle is unsafe for untrusted data and a local attacker or poisoned file could turn token loading into code execution.

Content

Scanner excerpt · scripts/yt_setup.py (reported line 18)May include surrounding context.

python

creds = None
    if os.path.exists(TOKEN_FILE):
        with open(TOKEN_FILE, 'rb') as f:
            creds = pickle.load(f)
    
    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file documents that an OAuth token is saved to ~/.yt_token.pickle, but it does not warn the user that this file contains sensitive authentication material or should be protected. For markdown files, SQP-2 applies when behaviour affecting privacy or system integrity is described without user-facing warning.

Content

No source excerpt is available for this finding.