Security audit

Seedance Video Creation

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a real video-generation integration, but it also has under-scoped external sharing guidance and a real local shell-execution risk that users should review before installing.

Install only if you are comfortable sending prompts, images, generated videos, and task metadata to Volcengine, and potentially to Feishu if you use the linked sharing guide. Avoid sensitive personal or proprietary images, replace any Feishu recipient IDs with your own verified destination, and do not use crafted or untrusted download paths until the macOS os.system opener is removed or replaced with a non-shell call.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: seedance.py:219
Finding: Shell Command Injection Through Attacker-Controlled Download Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: how_to_send_video_via_feishu_app.md:91
Finding: Concrete Feishu Recipient Identifier May Cause Unintended Video Disclosure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (30)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
## Execution (Recommended: Python CLI Tool) A Python CLI tool is provided at `~/.claude/skills/seedance-video/seedance.py` for robust execution with proper error handling, automatic retries, and local image base64 conversion. **Prefer using this tool over raw curl commands.** ### Quick Examples with Python CLI

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.
bash
echo "Waiting for video generation to complete..." while true; do STATUS_RESULT=$(curl -s -X GET "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks/${TASK_ID}" \ -H "Authorization: Bearer $ARK_API_KEY") STATUS=$(echo "$STATUS_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.
Query Task Status

bash
curl -s -X GET "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks/${TASK_ID}" \ -H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.
bash
# List all tasks (paginated) curl -s -X GET "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks?page_num=1&page_size=10" \ -H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool # Filter by status

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
-H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool

Filter by status

curl -s -X GET "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks?page_num=1&page_size=10&filter.status=succeeded"
-H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool

text

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
Cancel or Delete Task

bash
curl -s -X DELETE "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks/${TASK_ID}" \ -H "Authorization: Bearer $ARK_API_KEY"

os.system() or os exec-family call

High

Category: Dangerous Code Execution
Confidence: 95% confidence
Finding: The code invokes a shell via os.system() to open a downloaded file path on macOS. Even though the filename is locally constructed, shell invocation is unnecessary and increases risk surface; if path handling or surrounding assumptions change, this can become command-injection-prone, and it also causes automatic execution of a local handler for untrusted remote content.
Content: Scanner excerpt · seedance.py (reported line 230)May include surrounding context.
python
# Open on macOS if sys.platform == "darwin": os.system(f'open "{filepath}"') except Exception as e: print(f"Download failed: {e}", file=sys.stderr)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill clearly expects shell, network, and environment-variable access, but it does not declare any explicit tool scope or permissions boundary. That mismatch can cause an agent framework to grant broader capabilities than users expect, reducing transparency and increasing the chance of unintended command execution or external data transfer.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description explains how to generate videos but does not clearly warn that prompts and user-supplied images are sent to a third-party API provider. This can lead to unintentional disclosure of sensitive text, personal images, or proprietary content to an external service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This skill is designed to send prompts and possibly images to an external API, so outbound transmission is expected in context. However, it is still security-relevant because user content and potentially sensitive local files are transmitted to a third party, and the skill does not pair this with strong consent/privacy language.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
## Execution (Recommended: Python CLI Tool) A Python CLI tool is provided at `~/.claude/skills/seedance-video/seedance.py` for robust execution with proper error handling, automatic retries, and local image base64 conversion. **Prefer using this tool over raw curl commands.** ### Quick Examples with Python CLI

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The skill encourages asynchronous task creation, waiting, downloading, and later status checks using task IDs, which creates persistent remote artifacts and local references across sessions. In context this is operationally necessary, but it still has privacy implications because task history and downloadable media remain accessible for a period of time.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
Quick Examples with Python CLI

bash
# Text-to-video (create + wait + download) python3 ~/.claude/skills/seedance-video/seedance.py create --prompt "小猫对着镜头打哈欠" --wait --download ~/Desktop # Image-to-video from local file

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The image-to-video flow uploads user-provided image URLs or content to the external API, which is core functionality but still constitutes external data transfer. In this mode the risk is higher because image inputs may contain personal, biometric, or confidential visual information.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: This path converts a local image file to base64 and embeds it into the API request, causing direct upload of local file contents to a third-party service. That creates a clear exfiltration pathway for local data if users misunderstand what the command does or provide the wrong file path.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
IMG_BASE64=$(base64 < "$IMG_PATH" | tr -d '\n') IMG_DATA_URL="data:image/${IMG_EXT_LOWER};base64,${IMG_BASE64}" TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The first+last-frame workflow transmits multiple images plus prompt text to the remote service, increasing the amount of user content exposed externally. The capability is expected for this skill, but the privacy and data-handling implications are not made sufficiently explicit.
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
Requires two images. Supported by: Seedance 1.5 Pro, 1.0 Pro, 1.0 Lite I2V.

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: Reference-image generation uploads one or more user images and associates them with prompt semantics, which may reveal identities, preferences, or proprietary visual assets to the provider. This is intended behavior but still a real privacy-sensitive data transfer.
Content: Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.
Provide 1-4 reference images. Use [图1], [图2] in prompt to reference specific images.

bash
TASK_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow silently downloads generated content to the local filesystem and opens it automatically, but this side effect is not clearly disclosed as a user warning. Automatic file creation and opening can surprise users, overwrite expectations about local state, and increase exposure to malicious or inappropriate media content.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: Draft mode still transmits prompt content to the external provider and may lead users to believe preview mode is local or lower risk when it is not. The reduced cost does not reduce the privacy impact of sending the data off-device.
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
bash
# Step 1: Create draft DRAFT_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Generating a final video from a draft task continues processing user content through the external service, and users may not realize that task identifiers and draft artifacts remain associated with remotely stored content. This is not malicious, but it is still a real external-processing risk.
Content: Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.
md
DRAFT_TASK_ID=$(echo "$DRAFT_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") # Step 2: After draft succeeds, generate final video from draft FINAL_RESULT=$(curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Feishu/OpenClaw sending capability expands the skill beyond its stated purpose of video generation into external distribution of generated files. Scope creep like this increases exfiltration risk because users may invoke the skill expecting only generation, not transmission to a messaging platform.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document materially extends the skill from video generation into cross-system file transmission via the Feishu message tool and APIs, which is outside the stated scope of the skill. That scope expansion is dangerous because it teaches an agent/operator how to move locally generated files into an external chat system, increasing the chance of unintended data exfiltration or misuse of adjacent tooling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

Query Task Status

External Script Fetching

External Script Fetching

Filter by status

External Script Fetching

Cancel or Delete Task

os.system() or os exec-family call

Undeclared Tool Scope

Missing User Warnings

External Transmission

Session Persistence

Quick Examples with Python CLI

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

External Transmission

Context-Inappropriate Capability

Description-Behavior Mismatch

Static analysis