WayinVideo - Find Moments in the Video

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 2:21 AM UTC
• Version: 1.0.4

Overview

This skill is a coherent WayinVideo integration, but users should know that videos, video URLs, search queries, and result metadata may leave the local machine or be saved locally.

Use this skill only for videos, URLs, and search terms you are comfortable sending to WayinVideo. Prefer a scoped or revocable WAYIN_API_KEY, avoid confidential local recordings unless third-party processing is acceptable, and remember that result JSON files are saved locally under api_results by default.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/polling_results.py (reported line 38)May include surrounding context.

python

while True:
        try:
            req = urllib.request.Request(url, headers=HEADERS, method="GET")
            with urllib.request.urlopen(req, timeout=30) as response:
                response_text = response.read().decode("utf-8")

                data_res = json.loads(response_text).get("data", {})

Tainted flow: 'req' from os.environ.get (line 26, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/submit_task.py (reported line 29)May include surrounding context.

python

req = urllib.request.Request(BASE_URL, data=data, headers=HEADERS, method="POST")
    
    try:
        with urllib.request.urlopen(req, timeout=15) as response:
            status = response.getcode()
            response_text = response.read().decode("utf-8")

Tainted flow: 'req' from os.environ.get (line 62, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_video.py (reported line 63)May include surrounding context.

python

try:
        req = urllib.request.Request(init_url, data=init_payload, headers=init_headers, method="POST")
        with urllib.request.urlopen(req, timeout=30) as response:
            init_data = json.loads(response.read().decode("utf-8"))
        
        upload_url = init_data["data"]["upload_url"]

Tainted flow: 'req' from os.environ.get (line 62, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code takes an upload_url from the previous API response and blindly performs a PUT of the local file to that URL without validating the scheme, host, or expected storage provider. If the upstream API response is compromised or redirected, arbitrary local media could be exfiltrated to an attacker-controlled endpoint, which is especially sensitive because this skill handles user-supplied local files.

Content

Scanner excerpt · scripts/upload_video.py (reported line 87)May include surrounding context.

python

with open(file_path, 'rb') as f:
            req = urllib.request.Request(upload_url, data=f, headers=upload_headers, method="PUT")
            req.add_header("Content-Length", str(file_size))
            with urllib.request.urlopen(req) as response:
                if response.getcode() not in (200, 201, 204):
                    raise Exception(f"Failed to upload file. Status code: {response.getcode()}")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a user-facing search capability for locating moments in videos and exporting clips. In contrast, this code chunk is strictly an upload utility for local files. It checks file existence, size, and MIME/extension, requests a presigned upload URL from WayinVideo, uploads the file, and prints the returned identity for subsequent API calls. While uploading a local file could be a supporting step for a larger video-search workflow, this chunk by itself does not implement the declared core functionality and instead performs a materially different primary task.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/polling_results.py (reported line 12)May include surrounding context.

python

import urllib.request
import urllib.error

# Get API Key from environment variable
API_KEY = os.environ.get("WAYIN_API_KEY")

if not API_KEY:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit_task.py (reported line 9)May include surrounding context.

python

import urllib.request
import urllib.error

# Get API Key from environment variable
API_KEY = os.environ.get("WAYIN_API_KEY")

if not API_KEY:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/upload_video.py (reported line 10)May include surrounding context.

python

import urllib.request
import urllib.error

# Get API Key from environment variable
API_KEY = os.environ.get("WAYIN_API_KEY")

if not API_KEY:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes shell scripts, reads and writes files, accesses environment secrets, and makes network requests, but it declares no explicit tool scope or permission boundaries. That increases the chance an agent runtime will grant broader capabilities than users expect, making accidental data access, command execution, or exfiltration harder to constrain or audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to upload local files or downloaded content to a third-party API without requiring an explicit user-facing consent or privacy warning at the point of transfer. This can expose sensitive video content, embedded personal data, or confidential recordings to an external service unexpectedly, especially when local files are involved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill emits host-level system events by calling an external command, a capability unrelated to core moment-finding functionality. Because the event text incorporates remote task state and identifiers, the skill can influence host/UI messaging and generate repeated notifications, increasing the risk of abuse, operator deception, or noisy persistence-like behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 83% confidence

Finding

The code invokes an external host command (openclaw system event) with dynamically constructed text that includes remote API-derived values such as project_id and status information. While it does not use a shell, it still expands the skill's privileges beyond its stated video-processing purpose and creates a host-side side effect channel that could be abused for notification spam, misleading operator messages, or unsafe coupling to privileged local tooling.

Content

Scanner excerpt · scripts/polling_results.py (reported line 115)May include surrounding context.

python

def send_system_event(text):
    try:
        subprocess.run([
            "openclaw", "system", "event",
            "--text", text,
            "--mode", "now"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script transmits user-supplied video URLs and natural-language queries to a third-party API, which may expose sensitive internal URLs, private media locations, or confidential search terms without an explicit runtime warning or consent gate. In a skill context, users may not realize their inputs leave the local environment and are processed externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script persists submitted payload data and metadata to disk, including the user's query, video URL, project identifier, and task details, without an explicit user-facing notice. This can create an unintended local privacy leak, especially on shared workspaces, synced folders, or environments where api_results is collected or monitored.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for locating moments in videos and exporting clips, but this helper script introduces a separate credentialed upload capability by pulling WAYIN_API_KEY from the environment and failing if it is absent. Accessing environment-stored credentials is a broader operational capability than the user-facing purpose of semantic video search, and the manifest does not mention such credential handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest centers on natural-language search over videos and exporting clips, but this file is dedicated to uploading local files to WayinVideo and returning a reusable identity for later APIs. Uploading source media to a remote service may support the workflow, but as implemented here it is a distinct operational behavior not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The tip in L39-L40 says to 'Use English whenever possible,' which imposes a preferred language despite the skill supporting target-language options elsewhere. This is a natural-language locale preference that is not framed as optional user choice or clearly justified as a strict technical requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.