Embodied-OS - AI Robot Control System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:00 AM UTC
• Version: 0.1.0

Overview

The skill is mostly disclosed as robot-control tooling, but it asks for high-impact physical robot authority without enough safety scoping and also ships unrelated legacy video-generation instructions that could trigger risky command execution.

Review before installing. Use this only in simulation or a controlled robotics environment until dependencies are pinned and reviewed, live-hardware operation requires explicit human confirmation, and robot-side safety limits are enforced independently. Treat the bundled legacy video-generator files as a packaging error and do not let them auto-trigger or execute shell commands from user-supplied text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:35

Finding

Unpinned External Dependencies Are Retrieved and Executed

Content

View full analysis

.env ``` ```bash git clone https://github.com/ZhenRobotics/openclaw-video.git ~/openclaw-video cd ~/openclaw-video npm install echo 'OPENAI_API_KEY="sk-your-key-here"' > .env ``` From `SKILL-ZH-OLD-VIDEO.md:18-40`: ```bash clawhub install video-generator ``` ```bash git clone https://github.com/ZhenRobotics/openclaw-video.git ~/openclaw-video cd ~/openclaw-video npm install export OPENAI_API_KEY="sk-your-key-here" ``` ```bash npm install -g openclaw-video ``` ### Technical Analysis The instructions install packages without exact version constraints and clone the current head of remote repositories without pinning a reviewed commit hash. The audited artifact contains only documentation, so the external packages, installation scripts, lifecycle hooks, transitive dependencies, and runtime behavior cannot be verified from the supplied project. C ...[truncated 2261 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL-EN-OLD-VIDEO.md:88

Finding

Shell Command Injection Through Direct Interpolation of User-Supplied Video Scripts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The auto-trigger rules are extremely broad, matching generic mentions of 'video' or text that merely resembles a script. In this skill, broad triggering is especially dangerous because activation can lead to cloning a repository, installing packages, using API credentials, and running local scripts, turning ordinary conversation into high-risk execution flow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file is for a video-generation pipeline, while the enclosing skill metadata claims an embodied robot operating system. This scope mismatch can cause an agent to invoke unrelated installation, network access, and shell commands in the wrong trust context, increasing the chance of unsafe tool use and confusing policy boundaries.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL-OLD-VIDEO.md (reported line 32)May include surrounding context.

cd ~/openclaw-video npm install

Configure API key (create .env file)

echo 'OPENAI_API_KEY="sk-your-key-here"' > .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL-OLD-VIDEO.md (reported line 33)May include surrounding context.

cd ~/openclaw-video npm install

Configure API key (create .env file)

echo 'OPENAI_API_KEY="sk-your-key-here"' > .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL-OLD-VIDEO.md (reported line 47)May include surrounding context.

cd ~/openclaw-video npm install

Configure API key (create .env file)

echo 'OPENAI_API_KEY="sk-your-key-here"' > .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL-OLD-VIDEO.md (reported line 293)May include surrounding context.

cd ~/openclaw-video npm install

Configure API key (create .env file)

echo 'OPENAI_API_KEY="sk-your-key-here"' > .env

text

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The auto-trigger conditions are broad enough to activate on ordinary discussion of videos or any multi-sentence text resembling a script. In an agent setting, this can lead to unsolicited command execution, repository access, API consumption, and network activity without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to clone a remote GitHub repository and run npm install, which can execute arbitrary lifecycle scripts from externally fetched code. In an agent context, this creates a meaningful remote-code-execution and supply-chain risk, especially because the repository version is not pinned and no verification step is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill markets and demonstrates physical actions, autonomous monitoring, and task execution on real robots without prominent warnings, operator qualifications, environmental prechecks, or explicit human-in-the-loop constraints. Because the system targets embodied robots, missing safety framing is especially dangerous: misuse could cause property damage, injury, privacy violations, or unsafe autonomous behavior in homes, warehouses, or labs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The installation flow directs the agent to perform software installation and then execute project code locally as part of normal skill use. In skill context, that is dangerous because broad natural-language requests can trigger actions that materially change the host environment and run untrusted code without strong trust boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to clone and run code from a remote GitHub repository (git clone, npm install, shell scripts) on the local system. That creates a clear supply-chain and remote code execution risk, because the repository contents and dependency tree can execute arbitrary install scripts or malicious code under the user's account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples instruct agents to 'always use this skill' for broad natural-language requests. That removes discretion and can force unsafe tool use in contexts where the user may only be discussing video concepts, increasing the chance of unnecessary code execution and data exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The feature list states that no cloud services are required, but later notes explicitly say internet connectivity is required for TTS and Whisper APIs. These statements actively conflict because the described pipeline depends on external cloud services for core functionality.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL-EN-OLD-VIDEO.md (reported line 311)May include surrounding context.

md

**DON'T**:
- ❌ Run `npx remotion` to create new projects
- ❌ Assume project is installed without checking
- ❌ Ignore error messages
- ❌ Use hardcoded absolute paths (except `~` paths)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL-OLD-VIDEO.md (reported line 354)May include surrounding context.

md

**DON'T**:
- ❌ Run `npx remotion` to create new projects
- ❌ Assume project is installed without checking
- ❌ Ignore error messages
- ❌ Use hardcoded absolute paths (except `~` paths)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples say to 'always use this skill' for broad natural-language prompts, encouraging automatic activation without strong boundaries. This raises the risk of overreach, especially because the skill can run shell commands and consume paid APIs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Most user-facing instructions and agent guidance are presented only in Chinese, which effectively imposes a language choice without user opt-in. The document does not state that the skill is intended only for a Chinese-speaking or region-specific audience, nor does it offer an alternative language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill expands from simple video generation into repository cloning, dependency installation, and environment setup. That broadens the trust boundary substantially: an agent following these steps would fetch and prepare external code before producing a video, increasing exposure to supply-chain compromise or unsafe install scripts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are broad enough that ordinary discussion about making videos or providing multi-sentence text could auto-activate this skill. In context, unintended activation is more dangerous because the skill can lead to installing software and executing external project code, so misrouting a benign request can escalate into risky actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example trigger phrases are generic and overlap with normal conversation, making accidental invocation plausible. Because this skill is not read-only and can drive external tooling, overbroad examples materially increase the chance of unsafe automatic behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.