movie-monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.4.0

Overview

The skill matches its movie-download automation purpose, but it schedules cloud/NAS mutations through unreviewed local scripts and duplicated 115 cookies, so it should be reviewed before installation.

Install only if you trust and have audited the external scripts under the expected ~/.openclaw locations, can restrict the account to the intended 115 and NAS folders, and are comfortable with scheduled tasks that may rename remote cloud files and local media. Use a dedicated account, protect cookie files with strict permissions, and prefer manual preview/confirmation before cleanup or batch rename runs.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:43
• Finding: Execution of Unverified External and Relative Scripts## Vulnerability Details **File Location**: `SKILL.md`, lines 43-53 and 56-78 **Vulnerability Type**: Untrusted local script resolution and execution **Risk Level**: High ### Evidence ```bash node 115.js ls <cid> node 115.js rename "<old_name>" "<new_name>" <cid> python3 movie_pipeline.py --mode=monitor python3 copy_and_rename_movies.py python3 cleanup_and_rename.py python3 movie_pipeline.py --mode=full python3 batch_rename_115_cloud.py ``` The documented external script is located at: ```text ~/.openclaw/scripts/115-renamer/115.js ``` ### Technical Analysis The Skill directs the Agent to execute several Python and Node.js scripts, but none of those executable files is included in the audited project. The commands use relative script names such as `movie_pipeline.py` and `115.js`, making script selection dependent on the current working directory. The instructions do not require canonical path resolution, ownership verification, restrictive permissions, an integrity hash, or signature validation. Consequently, a local attacker or compromised process capable of creating or replacing a file in the effective working directory could cause a legitimate-looking command to execute attacker-controlled code. Because the referenced scripts are absent from the package, their behavior cannot be verified. This finding concerns the insecure execution mechanism and replacement risk; it does not establish that the absent scripts are themselves malicious. ### Attack Path 1. An attacker obtains write access to the directory from which a documented command will be run, or replaces an external script under `~/.openclaw/scripts`. 2. The attacker creates a malicious script named `movie_pipeline.py`, `cleanup_and_rename.py`, `batch_rename_115_cloud.py`, or `115.js`. 3. A user or scheduled Agent task invokes the corresponding command from `SKILL.md`. 4. Python or Node.js resolves and executes the att ...[truncated 852 chars]
• Remediation: ## Remediation Suggestions 1. Include all required scripts inside the reviewed Skill package so their implementation can be audited. 2. Resolve scripts relative to a trusted, immutable package directory instead of the current working directory. 3. Invoke scripts through canonical absolute paths. 4. Verify script ownership and reject files writable by unauthorized users or groups. 5. Pin and verify cryptographic hashes or signatures before execution. 6. Run the scripts under a dedicated least-privilege account with access limited to the required source and destination directories. 7. Prevent executable directories from being writable by untrusted users. 8. Apply API-side least privilege and require confirmation for destructive cloud rename or deletion operations. 9. Audit the missing Python and Node.js scripts before enabling the documented scheduled tasks.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:81
• Finding: Duplicated Plaintext Cloud Session Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 81-85 **Vulnerability Type**: Insecure storage and duplication of sensitive authentication material **Risk Level**: Medium ### Evidence ```python cookie_file = "~/.openclaw/scripts/movie-monitor/115_cookie_manual.json" renamer_cookie = "~/.openclaw/scripts/115-renamer/cookie.json" ``` The documentation requires the two cookie files to remain synchronized, causing the same or equivalent authentication material to be stored in multiple plaintext JSON files. ### Technical Analysis Session cookies are bearer credentials: possession may be sufficient to authenticate as the associated user until the session expires or is revoked. Maintaining copies in two filesystem locations increases the credential's attack surface and creates additional opportunities for disclosure through permissive file permissions, backups, logs, compromised scripts, or unrelated local processes. The Skill does not specify restrictive file permissions, secure secret storage, encryption at rest, credential rotation, access auditing, or redaction requirements. It also depends on unaudited external scripts that are expected to read these credentials. The audit did not find cookie values hardcoded directly in `SKILL.md`. The weakness is the documented plaintext duplication and lack of mandatory credential protections. ### Attack Path 1. An attacker gains read access to either documented cookie file through weak filesystem permissions, a compromised local script, a backup, or another process running as the same user. 2. The attacker extracts the 115 session cookie from the JSON data. 3. The attacker replays the bearer credential against the 115 service or uses it through the referenced API tooling. 4. The attacker accesses or modifies resources authorized by the stolen session until the cookie expires or is revoked. ### Impact Assessment The obtainable privileges are bounded by the permiss ...[truncated 550 chars]
• Remediation: ## Remediation Suggestions 1. Maintain a single credential source rather than synchronized plaintext copies. 2. Store the cookie in an operating-system credential manager, secret service, or similarly protected secret store. 3. If file storage is unavoidable, restrict the file and parent directory to the dedicated service account, such as mode `0600` for the file and `0700` for its directory. 4. Ensure cookie files are excluded from source control, diagnostic bundles, logs, and unencrypted backups. 5. Do not pass cookie values through command-line arguments or environment dumps that may be visible to other processes. 6. Rotate the existing session credential after migrating storage and immediately revoke it after suspected exposure. 7. Add automated permission and ownership checks before any script reads the credential. 8. Use a dedicated account or narrowly scoped token if the 115 service supports least-privilege authentication. 9. Audit every script that consumes the credential and ensure it never prints or transmits the cookie to unauthorized destinations.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger description is unusually broad, including requests to run tasks, inspect status, repair problems, or make any pipeline adjustment. In an agentic environment this can cause the skill to activate for loosely related user requests and initiate scraping, downloads, or file operations without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This section documents automatic renaming of both NAS files and 115 cloud folders/files as part of normal operation, but does not prominently warn that these are mutating and potentially irreversible actions. If invoked by an agent or user without clear awareness, it can rename large sets of local and remote media and make recovery difficult.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The cleanup command is presented as a routine operation even though it performs batch renaming/cleanup across cloud and local storage. Batch rename behavior can accidentally alter legitimate filenames or directories at scale, especially when driven by pattern-based cleanup rules, leading to data management errors and hard-to-reverse changes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The standalone batch cloud rename command directly modifies remote user data on the 115 service, yet it is shown without a warning about remote side effects. In the context of an automation skill, this increases the chance of silent large-scale cloud renames caused by ambiguous invocation or operator misunderstanding.

Static analysis

No suspicious patterns detected.