Trust Assessment
openclaw-media-gen received a trust score of 64/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Potential data exfiltration: file read + network send, Arbitrary File Write via Path Traversal in `--out` argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential data exfiltration: file read + network send Function '_download_to_file' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers. | Static | skills/aisadocs/openclaw-aisa-llm-image-video/scripts/media_gen_client.py:93 | |
| HIGH | Arbitrary File Write via Path Traversal in `--out` argument The `_download_to_file` function, used when the `--out` argument is provided, constructs a file path using user-controlled input without proper sanitization. An attacker can supply a path like `../../../../tmp/malicious.mp4` to write files to arbitrary locations on the filesystem. This could lead to overwriting critical system files, placing malicious executables, or other unauthorized file system modifications, potentially leading to privilege escalation or remote code execution. Sanitize the `out_path` argument to prevent path traversal. Ensure that the final path resolves to a location within an allowed, designated directory. This can be achieved by using `os.path.basename()` to extract only the filename and then joining it with a secure base directory, e.g., `out_path = os.path.join(secure_base_dir, os.path.basename(user_input_path))`. | LLM | scripts/media_gen_client.py:99 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/aisadocs/openclaw-aisa-llm-image-video/scripts/media_gen_client.py:24 |
Scan History
Embed Code
[](https://skillshield.io/report/6c7f48881050d9a3)
Powered by SkillShield