Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its video-creation purpose, but it needs Review because its CLI exposes sensitive login data to avoidable risks and can overwrite or delete arbitrary local files via a session-file option.
Review this before installing. Use it only if you are comfortable sending scripts and account workflow data to bollo.video or vibevideo.io. Avoid custom --api-base, --web-base, and --session-file arguments; prefer the default HTTPS endpoints and default OpenClaw secrets path, or --no-save for ephemeral login. A safer release should enforce HTTPS allowlisted origins and restrict session files to the intended secrets directory.
skills/vibevideoio-ai-script-to-video/scripts/vibevideo-studio.mjs:408HTTPS Downgrade Allows Exposure of Authentication Credentials, Tokens, and User Scripts
skills/vibevideoio-ai-script-to-video/scripts/vibevideo-studio.mjs:236Unrestricted Session File Path Enables Arbitrary File Overwrite and Deletion
If the underlying code really supports Google OAuth, WeChat login, identity/profile access, token management, access-control features, or service flag mutation beyond the stated purpose, that is a meaningful privilege expansion. In an agent skill, undeclared identity, session, and account-management capabilities can lead to credential misuse, account takeover assistance, or unauthorized administrative actions under a misleadingly narrow description.
If the underlying code really supports Google OAuth, WeChat login, identity/profile access, token management, access-control features, or service flag mutation beyond the stated purpose, that is a meaningful privilege expansion. In an agent skill, undeclared identity, session, and account-management capabilities can lead to credential misuse, account takeover assistance, or unauthorized administrative actions under a misleadingly narrow description.
If the underlying code really supports Google OAuth, WeChat login, identity/profile access, token management, access-control features, or service flag mutation beyond the stated purpose, that is a meaningful privilege expansion. In an agent skill, undeclared identity, session, and account-management capabilities can lead to credential misuse, account takeover assistance, or unauthorized administrative actions under a misleadingly narrow description.
If the underlying code really supports Google OAuth, WeChat login, identity/profile access, token management, access-control features, or service flag mutation beyond the stated purpose, that is a meaningful privilege expansion. In an agent skill, undeclared identity, session, and account-management capabilities can lead to credential misuse, account takeover assistance, or unauthorized administrative actions under a misleadingly narrow description.
If the underlying code really supports Google OAuth, WeChat login, identity/profile access, token management, access-control features, or service flag mutation beyond the stated purpose, that is a meaningful privilege expansion. In an agent skill, undeclared identity, session, and account-management capabilities can lead to credential misuse, account takeover assistance, or unauthorized administrative actions under a misleadingly narrow description.
If the underlying code really supports Google OAuth, WeChat login, identity/profile access, token management, access-control features, or service flag mutation beyond the stated purpose, that is a meaningful privilege expansion. In an agent skill, undeclared identity, session, and account-management capabilities can lead to credential misuse, account takeover assistance, or unauthorized administrative actions under a misleadingly narrow description.
Referenced artifact was not completely inspected
- `skills/vibevideoio-ai-script-to-video/scripts/vibevideo-studio.mjs`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Phase 2
- email-code fallback
- access token overview
- provider-side task polling UI
### Phase 3
The documented flow includes taking a local access token and writing it into browser cookies, which is a sensitive credential-handling operation. In an agent-integration context, any unnecessary exposure of token setup flows increases the risk of session fixation, token misuse, or unauthorized account access if the bridge or agent can obtain or replay those values.
- `GET /api/auth/email-verify`
- magic-link verification redirect
- `POST /api/auth/email-token-setup`
- writes cookies from a local access token
- `PUT /api/access/tokens/{token_id}`
- can expire the current saved session token during logout
A DELETE endpoint for sub-user management is a high-risk capability because an agent intended only for video creation could be induced to remove users or alter account access. In this skill context, the mismatch is especially dangerous: destructive identity-management actions are unrelated to the user-facing task and create a clear path for tool-parameter abuse if the agent can be prompted to target arbitrary sub_user_id values.
- `GET /api/access/sub-users`
- `POST /api/access/sub-users`
- `PUT /api/access/sub-users/{sub_user_id}`
- `DELETE /api/access/sub-users/{sub_user_id}`
- `GET /api/access/tokens`
- `PUT /api/access/tokens/{token_id}`
The checklist recommends storing an issued access token in a local OpenClaw session file. File-based local token storage can increase exposure to token theft through local compromise, weak file permissions, accidental persistence, or unintended reuse beyond the intended session lifetime; in a bridge/provider integration, that could allow unauthorized access to user video accounts and project actions.
For the current Studio bridge runtime:
- default site selection to `bollo.video`
- let users switch explicitly to `vibevideo.io`
- store the issued access token in a local OpenClaw session file instead of relying on browser cookies
## 3. Choose Auth Strategy
- prefer `session_handoff`
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- do not expose the primary auth cookie to the provider
- set a short bridge token TTL
- whitelist provider origins
- log session issuance and exchange events
- keep provider scopes explicit and revocable
## 6. OpenClaw-Specific Recommendation
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if (optional) {
return "";
}
return promptValue(rl, label, defaultValue, { optional });
}
async function promptChoice(rl, label, options, defaultIndex = 0) {
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if (optional) {
return "";
}
return promptValue(rl, label, defaultValue, { optional });
}
async function promptChoice(rl, label, options, defaultIndex = 0) {
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if (optional) {
return "";
}
return promptValue(rl, label, defaultValue, { optional });
}
async function promptChoice(rl, label, options, defaultIndex = 0) {
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if (optional) {
return "";
}
return promptValue(rl, label, defaultValue, { optional });
}
async function promptChoice(rl, label, options, defaultIndex = 0) {
The script receives an access token from the remote service and persists it to a local session file for reuse. Although this supports normal authentication, stored bearer tokens are highly sensitive: if the local file is exposed through weak host isolation, backups, logs, or multi-user environments, an attacker can reuse the token to access the victim's account and perform authenticated actions.
const accessToken = normalizeToken(verifyPayload?.data?.access_token || "");
if (!accessToken) {
throw createApiError("Login succeeded but access token is missing");
}
const storedSession = {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
path: "/api/auth/callback",
responseContract: "legacy",
localeHeader: true,
notes: "Returns a local VibeVideo access token.",
},
tags: ["auth", "google", "oauth"],
},
The skill advertises capabilities that inherently require sensitive operations such as network access, shell execution, and possibly environment variable use, but the manifest shown does not declare any explicit tool or permission scope. In an agent setting, missing scope boundaries increases the risk of over-privileged execution, making it harder to enforce least privilege or prevent unintended access paths.
The description is broad enough to match common user requests like 'make a video' or 'generate an AI video' without clearly limiting when the skill should activate. Over-broad invocation criteria can cause an agent to trigger networked login and content-generation workflows unexpectedly, increasing the risk of unintended external actions and data disclosure.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# VibeVideoIO AI Script to Video
This package exposes a single canonical skill:
- `skills/vibevideoio-ai-script-to-video/SKILL.md`
## Install Notes
- Local OpenClaw skill registration is manual via `npm run openclaw:register`
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# VibeVideoIO AI Script to Video
This package exposes a single canonical skill:
- `skills/vibevideoio-ai-script-to-video/SKILL.md`
## Install Notes
- Local OpenClaw skill registration is manual via `npm run openclaw:register`
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# VibeVideoIO AI Script to Video
This package exposes a single canonical skill:
- `skills/vibevideoio-ai-script-to-video/SKILL.md`
## Install Notes
- Local OpenClaw skill registration is manual via `npm run openclaw:register`
The 'When To Use' section includes very common, ambiguous phrases that overlap with generic creative-assistant requests. In the context of a skill that may authenticate to third-party services and submit user content remotely, ambiguous triggers make accidental invocation materially more dangerous.
Automatically choosing a site based on language introduces hidden routing of user data and credentials to one of two services without explicit consent. In a login- and project-management skill, silent site selection can create privacy, account confusion, and wrong-tenant risks, especially if users have different accounts or expectations across domains.
No suspicious patterns detected.