T09 · Insecure Skill Coding Practices
Error
- Location
seedance2.0.ts:53- Finding
API Credentials Can Be Forwarded to an Untrusted Configurable Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
seedance2.0
Security checks for vulnerabilities and agentic risk
Overview
This Seedance video skill is mostly coherent, but it handles an API key and network downloads in ways that deserve manual review before installation.
Install only if you trust the publisher and can keep ARK_BASE_URL fixed to the legitimate Volcengine endpoint. Use a limited-scope ARK_API_KEY, expect prompts/reference media URLs to be sent to the configured API service, and expect generated videos to be saved locally. Review or patch URL validation and download limits before running this in a sensitive network or shared environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
seedance2.0.ts:178- Finding
Unvalidated API-Provided Video URL Enables Server-Side Request Forgery and Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
package.json:13- Finding
Unpinned Dependency Installation Is Not Reproducible
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
复制环境变量模板：
bash cp .env.example .env编辑
.env文件，填入你的ARK_API_KEY：
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared behavior does not fully match the described capabilities: it advertises text/image generation support, omits that files may be downloaded locally, and apparently supports broader multimodal reference inputs than the description states. Description-behavior mismatch is dangerous because users may authorize or invoke the skill without understanding its actual data flows, local filesystem effects, or expanded input surface.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts // 加载环境变量 import dotenv from 'dotenv'; dotenv.config({ path: path.join(__dirname, '.env') }); // 默认提示词模板配置 export const PROMPT_TEMPLATES = {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README content is entirely in Chinese and does not offer an alternative language or indicate that the skill is intentionally limited to Chinese-speaking users. This can violate a language/locale policy when the skill forces a specific language without user opt-in or justification.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares access to environment variables and networked API behavior but does not explicitly scope or disclose allowed tools/permissions. This weakens least-privilege controls and can cause users or hosting platforms to approve broader capabilities than they intended, especially because the skill reads API credentials and performs remote requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file’s user-facing description and instructions are entirely in Chinese, which effectively forces a specific language without any opt-in or explanation. Under the stated policy, language constraints should either be user-selectable or clearly documented as region-specific and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that it automatically downloads generated videos to the local machine but does not provide a user-facing warning or consent mechanism for filesystem side effects. Silent local writes are risky because they can consume storage, overwrite expected workflow boundaries, and create privacy or malware-triage concerns if users do not realize files are being persisted.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The activation phrase for video generation is broad and underspecified, which can cause the skill to trigger in contexts the user did not clearly intend. For a networked, credential-backed generation workflow that may also download files, ambiguous triggering increases the risk of unintended API calls, cost incurrence, and unexpected content generation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code's user-facing natural language is written exclusively in Chinese in the header comments and later CLI/help output, with no indication that users can opt into another language. The policy requires flagging language or locale constraints when the skill forces a specific language without user choice or a clearly justified region-specific scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown explicitly states that generated videos are automatically downloaded to the local machine, which affects user storage and creates files on disk. The README does not include any warning or disclosure about where files are saved by default, possible overwrites, or local data impact.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The markdown instructs the skill to read
ARK_API_KEYfrom environment variables, which involves sensitive credential handling. While configuration is documented, there is no explicit warning to users that the skill depends on a secret and may use it for external API calls.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The package description is written entirely in Chinese and does not indicate that the skill is Chinese-only, region-specific, or that users can choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "author": "Zoe", "license": "MIT", "dependencies": { "dotenv": "^16.4.5" }, "openclaw": { "install": [
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- seedance2.0.ts:53