Seedance 2.0 电商带货视频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill is purpose-aligned for generating Qinghu/Seedance product videos, but it needs review because it asks for an API key in chat and permits broad mutable installs and upgrade-command execution.

Review this skill before installing. Use a minimally scoped Qinghu API key if available, avoid pasting secrets into chat, prefer configuring credentials locally, and approve any package install or upgrade command only after checking the exact command and source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51
• Finding: Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51-54, 77-79, 90` **Vulnerability Type**: Supply-chain exposure through mutable dependencies **Risk Level**: Medium ### Complete Relevant Snippets ```bash npm i -g @iqinghu/qhkit ``` ```text If the official registry is slow or times out, add: --registry=https://registry.npmmirror.com If global installation fails because of permissions, use: npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i original-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the agent to install or execute third-party packages without pinning exact versions or verifying package integrity. The use of `@latest`, omitted versions, and `npx --yes` permits the executed package content to change after the Skill has been reviewed. The fallback use of npm and pip mirrors broadens the set of infrastructure that must be trusted. Global installation of `@iqinghu/qhkit` also modifies the user's environment beyond the immediate video-generation task. Package installation is relevant to the declared functionality, but mutable global installation and unattended `npx` execution exceed the safest minimum required. Unlike the separately flagged Node.js archive download, these package operations do not include a checksum or other integrity verification. ### Attack Path 1. An attacker compromises a package publisher account, package release, registry, mirror, or dependency in the package tree. 2. The agent installs the mutable package version through npm or pip, or executes it directly through `npx --yes`. 3. Package lifecycle scripts or runtime code execute with the privileges of the agent's operating-system account. 4. The malicious package reads accessible files, API credentials, media assets, or environment variables. 5. The package may transmit the collected informatio ...[truncated 750 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version; do not use `@latest` or omitted versions. 2. Use a lockfile and verified package integrity hashes where supported. 3. Replace `npx --yes` with a locally installed, pinned executable. 4. Prefer a project-local installation instead of global npm installation. 5. Require explicit user approval before installing or upgrading packages. 6. Use primary registries by default. Only use a mirror after explicit user approval and document the additional trust boundary. 7. Run dependency installation and media processing in a restricted sandbox with access only to required files. 8. Disable unnecessary npm lifecycle scripts where compatible, for example by using `--ignore-scripts`, and enable them only after review when required. 9. Maintain an allowlist of approved package names, versions, registries, and integrity values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:74
• Finding: Service-Controlled Output Is Treated as an Executable Upgrade Instruction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:74` **Vulnerability Type**: Command injection through trusted execution of external output **Risk Level**: High ### Complete Relevant Snippet The relevant instruction, translated into English, states: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it as given. ``` ### Technical Analysis The Skill creates an execution path from a CLI or remote service response to the local shell. It explicitly directs the agent to execute the upgrade command supplied in the returned `message` field without constraining the command to an allowlist or validating its arguments. The expected response may normally contain a legitimate npm upgrade command. Nevertheless, the response is external data rather than trusted static code. A compromised `qhkit` executable, package update, backend service, network trust boundary, or spoofed executable earlier in `PATH` could return an arbitrary command. This is more dangerous than merely displaying an error message because it turns control over a data field into local command execution. ### Attack Path 1. An attacker compromises or replaces the local `qhkit` executable, compromises its backend, or otherwise controls the returned response. 2. The malicious component returns a response such as `{"ok":false,"stage":"version","message":"<attacker command>"}`. 3. The agent interprets the `message` value as an authorized upgrade command because the Skill says to execute it directly. 4. The command runs in a shell with the agent's operating-system privileges. 5. The command can download additional payloads, access local data, alter user configuration, or destroy files. ### Impact Assessment Successful exploitation can result in arbitrary shell command execution under the agent's user account. The affected scope includes all files, credentials, processes, and network resources available to that account. Pote ...[truncated 513 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never execute commands taken from `message`, stderr, stdout, or any other externally controlled response field. 2. Replace the instruction with a hard-coded upgrade workflow using an approved, exact package version. 3. Parse only a strictly validated semantic version from the response and construct the command internally. 4. Reject command separators, shell metacharacters, URLs, paths, and unexpected fields. 5. Maintain an allowlist of permitted executables and fixed arguments. 6. Display unexpected upgrade messages to the user as text rather than executing them. 7. Require explicit user approval before any package installation or upgrade. 8. Verify package provenance and integrity before applying an upgrade. 9. Invoke package-management commands directly without an intermediate shell where possible. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:64
• Finding: API Token Is Requested Through the Conversation Channel<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64-70` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Low ### Complete Relevant Snippet The relevant instruction, translated into English, states: ```text Create or copy an API key. After generating it, send the API key to me. After receiving the key, execute: qhkit config set --token <key> --env prod Alternatively, set: QHKIT_TOKEN ``` ### Technical Analysis An API token is necessary to authenticate to the declared Qinghu service. However, the Skill instructs the user to send the token to the agent through the conversation channel. Conversation content may be retained in chat history, telemetry, debugging records, or other application logs. Passing the token as a command-line argument may also expose it through shell history or process inspection, depending on how the command is executed. The environment-variable alternative reduces command-line exposure but still requires careful secret handling. There is no evidence that the Skill intentionally sends the token to an unauthorized service. The issue is the avoidable exposure of a legitimate secret through plaintext interaction and command invocation. ### Attack Path 1. The user follows the Skill and pastes the API token into the conversation. 2. The token becomes part of conversation history or associated logging and telemetry. 3. A person or system with access to those records obtains the token. 4. The exposed token is used to access the Qinghu account or consume its available service credits until it expires or is revoked. An alternative path exists if the token is placed directly in a shell command and subsequently retained in shell history or observed in process arguments. ### Impact Assessment Impact is limited to the permissions granted to the exposed Qinghu API token. Depending on service-side authorization, an attacker may be able to: - Consume the account's generation credits. - Submit generation ...[truncated 266 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API tokens into the conversation. 2. Instruct users to configure the token themselves through a private secret-management interface. 3. Prefer a protected environment-variable or credential-store mechanism. 4. Avoid placing tokens in command-line arguments. 5. Ensure configuration and diagnostic output always redact tokens. 6. Prevent tokens from being written to shell history, application logs, telemetry, or generated parameter files. 7. Document token scope, storage location, expiration, rotation, and revocation procedures. 8. Recommend a minimally scoped token when the service supports scoped credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to ask the user to send an API key in chat and then use it for local configuration. This creates a direct plaintext credential collection path through the conversation channel, increasing the risk of secret exposure in chat logs, model context, telemetry, screenshots, or downstream tooling.

Static analysis

No suspicious patterns detected.