ClawHub
Back to skill

Security audit

OpenClaw Video Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill’s goal is legitimate, but it asks users to install unaudited mutable code and give it credentials that can publish content publicly across multiple platforms.

Review this before installing. Use only narrowly scoped, revocable platform API credentials, avoid global installation when possible, and pin to a reviewed package version or full Git commit before running npm install. Do not allow automated or scheduled publishing unless you explicitly control which files, platforms, accounts, and times are allowed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:55
Finding

Unpinned and Unverifiable Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: skill.md:53-60, skill.md:257-259, and readme.md:39-46
Vulnerability Type: Untrusted supply-chain dependency installation
Risk Level: Medium

Vulnerable Code

From skill.md:53-60:

bash
# Method 1: Install through npm
npm install -g openclaw-video-publisher

# Method 2: Clone the repository
git clone https://github.com/ZhenRobotics/openclaw-video-publisher.git
cd openclaw-video-publisher
npm install

From skill.md:257-259:

markdown
- **Verification repository**: https://github.com/ZhenRobotics/openclaw-video-publisher
- **Verification commit**: [pending release]

Equivalent installation instructions appear in readme.md:39-46:

bash
# Install through npm
npm install -g openclaw-video-publisher

# Alternatively, clone the project
git clone https://github.com/ZhenRobotics/openclaw-video-publisher.git
cd openclaw-video-publisher
npm install

Technical Analysis

Both documented installation methods obtain mutable content from external sources without pinning it to an audited npm version, Git commit, integrity digest, or lockfile. The npm command installs the package globally, while the Git workflow checks out the repository's current default branch and resolves dependencies according to its current package metadata.

npm installation can execute package lifecycle scripts, including scripts defined by the primary package or relevant dependencies. Consequently, installation is not merely a data download: code controlled by the remote package publisher may execute with the permissions of the user running npm.

The alternative Git workflow does not eliminate this risk. The repository's default branch can change after the Skill has been reviewed, and the subsequent npm install may retrieve mutable transitive dependencies. The documentation refers to a verification repository but explicitly provides no verification com ...[truncated 2215 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm package to an exact reviewed version rather than installing the latest mutable release.
  2. Publish and document the integrity digest for the reviewed package artifact, and verify it before installation.
  3. For Git-based installation, require checkout of a full, reviewed commit hash rather than the repository's default branch.
  4. Replace the pending verification field with the exact audited commit and ensure release artifacts are reproducibly derived from that commit.
  5. Include the implementation, package.json, lockfile, installation scripts, and relevant tests in the auditable Skill artifact.
  6. Commit and enforce a lockfile using deterministic installation such as npm ci.
  7. Audit direct and transitive dependencies for known vulnerabilities, unexpected ownership changes, lifecycle scripts, and package-name confusion.
  8. Initially inspect dependencies with lifecycle scripts disabled, such as through npm install --ignore-scripts, and explicitly review any scripts before permitting execution.
  9. Avoid global installation unless technically necessary. Prefer a dedicated, least-privileged environment, container, or isolated service account.
  10. Limit the runtime process to only the media files and credentials required for explicitly selected platforms, and use narrowly scoped, revocable API tokens.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · readme.md (reported line 54)May include surrounding context.

bash
# 复制配置模板
cp config/platforms.example.json config/platforms.json
cp .env.example .env

# 编辑配置文件，填入各平台的 API 凭证
nano config/platforms.json

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 68)May include surrounding context.

bash
# 1. 复制配置模板
cp config/platforms.example.json config/platforms.json
cp .env.example .env

# 2. 编辑 .env 填入 API 凭证
nano .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 70)May include surrounding context.

bash
# 1. 复制配置模板
cp config/platforms.example.json config/platforms.json
cp .env.example .env

# 2. 编辑 .env 填入 API 凭证
nano .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 71)May include surrounding context.

bash
# 1. 复制配置模板
cp config/platforms.example.json config/platforms.json
cp .env.example .env

# 2. 编辑 .env 填入 API 凭证
nano .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 214)May include surrounding context.

bash
# 1. 复制配置模板
cp config/platforms.example.json config/platforms.json
cp .env.example .env

# 2. 编辑 .env 填入 API 凭证
nano .env

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents uploading videos, titles, descriptions, tags, and scheduling data to multiple external platforms, and later shows saved publication history. While it mentions credential safety and API limits, it does not explicitly warn users that their content and metadata will be sent to third-party platforms and that publish records are stored locally, which are privacy- and data-impacting behaviors.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The heading explicitly labels the document as an AI agent guide in Chinese, and the entire skill guidance and example interactions are written only in Chinese. This creates a language/locale constraint for agent use without documenting user choice, opt-in, or a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The natural-language guidance throughout the file is presented exclusively in Chinese, and the document does not indicate that the skill is intentionally limited to Chinese-speaking users or provide an alternative language option. Under the stated policy, forcing a specific language without user opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.