ClawHub
Back to skill

Security audit

Video Call AI Character

Security checks for vulnerabilities and agentic risk

Overview

This video-call skill is mostly purpose-aligned, but it needs review because it runs an unpinned npm service and handles recorded calls, transcripts, images, and user context with weak consent boundaries.

Review before installing. Use this only if you are comfortable with Runway processing avatar images, call audio/video, transcripts, and recordings. Pin and audit the npm runtime before use, keep cloudflared disabled unless needed, minimize user context in avatar prompts, and require explicit user consent before initiating, recording, downloading, or forwarding any call artifacts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:42
Finding

Unpinned Third-Party npm Package Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 42
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

The Skill declares the mutable npm package without a version or integrity constraint:

yaml
metadata: {"openclaw":{"emoji":"📞","requires":{"env":["RUNWAYML_API_SECRET"],"bins":["node","npm"]},"install":[{"id":"node","kind":"node","package":"openclaw-video-call","bins":["openclaw-video-call"],"label":"Install Video Call (npm)"}],"primaryEnv":"RUNWAYML_API_SECRET","source":"https://www.npmjs.com/package/openclaw-video-call","repository":"https://github.com/runwayml/openclaw-skills/tree/main/video-call-ai-character"}}

It then instructs the Agent to execute the package through npx:

bash
npx openclaw-video-call

Technical Analysis

Neither the package declaration nor the npx command pins an exact audited version. The project also contains no lockfile, integrity hash, vendored implementation, or local runtime source through which the executed package could be verified.

When the package is not already available locally, npx openclaw-video-call can resolve, download, and immediately execute the version currently selected by the npm registry. The effective executable payload can therefore change after this Skill has been reviewed. Package lifecycle scripts and the package runtime may execute with the operating-system privileges of the user running the Agent.

The runtime implementation is not included in the audited project, so this finding does not establish that the current npm package is malicious. It establishes that the documented installation and execution process lacks reproducibility and creates a supply-chain execution boundary controlled by a mutable external dependency.

Attack Path

  1. An attacker compromises the npm publisher account, package distribution process, or a future package release.
  2. The attacker publishes a malicious versi ...[truncated 1100 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version, such as openclaw-video-call@X.Y.Z, in both installation metadata and command examples.
  2. Install the dependency ahead of execution using a committed lockfile, and run the locally installed binary rather than allowing npx to retrieve an unspecified release.
  3. Record and verify the expected package integrity hash. Use deterministic installation such as npm ci with a reviewed lockfile.
  4. Review the resolved package contents, transitive dependencies, lifecycle scripts, and release provenance before approving updates.
  5. Disable package lifecycle scripts during installation where they are unnecessary, for example with npm ci --ignore-scripts, and explicitly enable only reviewed setup steps.
  6. Run the service in a restricted environment with minimum filesystem and network permissions. Provide RUNWAYML_API_SECRET only to the component that requires it.
  7. Add automated dependency monitoring and require manual security review whenever the pinned package or its lockfile changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
## Privacy & Data Handling

- **Runway API**: Only data you explicitly pass (avatar image, personality text, call audio/video) is sent to Runway ([dev.runwayml.com](https://dev.runwayml.com)). Nothing is uploaded automatically. Avatars can be deleted anytime via `DELETE /v1/avatars/{id}`.
- **Personality**: The avatar personality is built from the agent's own identity — its name, communication style, and knowledge of the user. No local files are read; the agent uses context it already has.
- **Tunnel**: The cloudflared tunnel is optional and only needed if the user answers calls from a different device. Without it, everything stays on localhost. No tunnel is created unless you explicitly install and run cloudflared.
- **npm package**: The runtime is published at [npmjs.com/package/openclaw-video-call](https://www.npmjs.com/package/openclaw-video-call). Source code: [github.com/runwayml/openclaw-skills](https://github.com/runwayml/openclaw-skills/tree/main/video-call-ai-character).

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells the agent to initiate a call, wait for it to end, retrieve the full transcript and recording, and send that content onward, but it does not require an explicit warning or fresh consent before recording and summarizing. This is dangerous because users may be unexpectedly recorded and have sensitive spoken content redistributed across channels.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description broadly encourages the agent to initiate calls for 'standups, urgent alerts, check-ins, or any conversation that's better face-to-face,' which can cause over-triggering in normal conversational contexts. In an agentic environment, this raises the likelihood of unsolicited contact, privacy surprises, and accidental escalation into a recording workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs users to execute npx openclaw-video-call without pinning a version or integrity source, which creates a supply-chain risk: future package changes or a compromised package release could execute unintended code. Because this skill also handles sensitive audio/video and transcripts, running an unpinned package increases exposure beyond a normal utility install.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Before creating a new avatar, check if you already have one:

bash
curl http://localhost:7891/api/avatars

If the response contains an avatar, use its id and skip to "Making a Call". Only create a new avatar if the list is empty.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill directs the agent to embed user-specific context, preferences, timezone, projects, and related details into the avatar personality prompt for reuse. That creates a data-minimization problem and can disclose more personal context to the external service than is necessary for the immediate call.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The referenced https://api.dev.runwayml.com/ endpoint confirms outbound transmission to a third-party service. Given the skill's instructions to build prompts from agent and user context, the risk is contextual: personal or sensitive information may be transferred off-device without sufficiently strong consent boundaries.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

  1. Generate one with Runway text-to-image — if none of the quick picks fit your character, or if the user specifically asks for a custom avatar look. Use the Runway API with model gemini_2.5_flash:
bash
curl -X POST https://api.dev.runwayml.com/v1/text_to_image \
  -H "Authorization: Bearer $RUNWAYML_API_SECRET" \
  -H "X-Runway-Version: 2024-11-06" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The referenced https://api.dev.runwayml.com/ endpoint confirms outbound transmission to a third-party service. Given the skill's instructions to build prompts from agent and user context, the risk is contextual: personal or sensitive information may be transferred off-device without sufficiently strong consent boundaries.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

  1. Generate one with Runway text-to-image — if none of the quick picks fit your character, or if the user specifically asks for a custom avatar look. Use the Runway API with model gemini_2.5_flash:
bash
curl -X POST https://api.dev.runwayml.com/v1/text_to_image \
  -H "Authorization: Bearer $RUNWAYML_API_SECRET" \
  -H "X-Runway-Version: 2024-11-06" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The upload flow sends image data to Runway using an external upload URL, which is a genuine external data transfer. If the uploaded image is user-provided or identifying, this can expose biometric or personal data to a third party without clear consent and retention controls.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Step 1: Create an upload URL

bash
curl -X POST https://api.dev.runwayml.com/v1/uploads \
  -H "Authorization: Bearer $RUNWAYML_API_SECRET" \
  -H "X-Runway-Version: 2024-11-06" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

List existing avatars

bash
curl http://localhost:7891/api/avatars

Making a Call

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file instructs the agent to fetch the full transcript and recording after the call, then resend and summarize them in another user channel. This broadens the distribution of sensitive conversational data and creates unnecessary retention and exposure risk, especially if the follow-up channel differs from the original call medium.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.