drama generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:31 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it claims, but it asks users to install mutable external code globally and send scripts or audio through cloud AI providers without enough privacy or install-scope disclosure.

Install only if you are comfortable running an external, unpinned npm/GitHub CLI. Prefer a pinned version or verified commit, run it in a limited workspace, use narrowly scoped provider keys, and avoid confidential or regulated scripts unless your chosen TTS/Whisper provider is approved for that data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: readme.md:34

Finding

Unpinned Third-Party Package and Repository Installation

Content

View full analysis

Vulnerability Details

File Location: readme.md:34-42, duplicated at readme.md:373-381, skill.md:76-81, and skill.md:221-226
Vulnerability Type: Unpinned and mutable external dependencies
Risk Level: Medium

Vulnerable Code

bash

# npm global installation
npm install -g openclaw-drama-generator

# Or clone from GitHub
git clone https://github.com/ZhenRobotics/openclaw-drama-generator.git
cd openclaw-drama-generator
npm install

Technical Analysis

The installation instructions retrieve mutable third-party content without specifying an exact npm version, Git commit hash, package integrity value, or reviewed lockfile. Consequently, the code installed by these commands can differ from the version that existed when this skill documentation was reviewed.

Both npm package installation and the subsequent dependency installation may execute package lifecycle scripts, such as preinstall, install, or postinstall. The global installation variant executes these operations in the user's environment and exposes the installed CLI system-wide for that user. The repository-based installation also checks out the repository's current default branch rather than a reviewed commit.

The audited artifact contains only readme.md and skill.md; it does not include the referenced implementation, package manifest, dependency lockfile, or scripts. Therefore, the security properties of the remotely installed package and its transitive dependencies cannot be verified from the submitted artifact.

Attack Path

1. An attacker compromises the referenced npm package, GitHub repository, maintainer account, publishing token, or a transitive dependency.
2. The attacker publishes a malicious package release or modifies the repository's default branch.
3. A user follows the documented unpinned installation instructions.
4. npm retrieves the attacker-controlled version and may execute malicious lifecycle scrip ...[truncated 975 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to an exact reviewed version rather than installing the latest mutable release:

   bash

   npm install -g openclaw-drama-generator@2.0.0
   

2. Prefer a project-local installation over a global installation and invoke the pinned binary through a controlled package script.

3. For repository-based installation, pin and verify a reviewed commit:

   bash

   git clone https://github.com/ZhenRobotics/openclaw-drama-generator.git
   cd openclaw-drama-generator
   git checkout --detach VERIFIED_COMMIT_HASH
   

4. Include a reviewed package-lock.json and use npm ci so dependency resolution cannot silently drift.

5. Verify npm package provenance, signatures, and integrity metadata before installation.

6. Audit all direct and transitive dependencies, including package lifecycle scripts. Where compatible with the package, initially install with lifecycle scripts disabled for inspection:

   bash

   npm ci --ignore-scripts
   

7. Run video generation in an isolated, least-privilege environment with access only to required input and output directories.

8. Provide cloud credentials only at execution time, use narrowly scoped credentials where providers support them, and rotate credentials after any suspected package compromise.

9. Vendor the reviewed implementation into the audited artifact or provide the package manifest, lockfile, and executable scripts so the complete runtime behavior can be assessed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly instructs users to configure third-party provider API keys and use cloud TTS/Whisper services, which implies that user scripts and generated audio may be sent to external vendors. However, it does not clearly warn users that potentially sensitive script content and audio/transcript data will leave the local environment and be processed by external services, creating a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 314)May include surrounding context.

echo $OPENAI_API_KEY

测试连接

curl https://api.openai.com/v1/models
-H "Authorization: Bearer $OPENAI_API_KEY"

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · readme.md (reported line 328)May include surrounding context.

brew install ffmpeg

Ubuntu 安装

sudo apt-get install ffmpeg

text

#### Q: 角色声音不合适

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs users to provide drama script content and advertises use of external providers such as OpenAI, Azure, Alibaba Cloud, and Tencent Cloud TTS, plus Whisper-based transcription, but it does not warn that user-supplied script text and derived audio may be transmitted to third-party services. This creates a privacy and data-handling transparency issue: users may unknowingly submit confidential, proprietary, or personal content to external APIs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.