Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed AI video/image generation client that sends prompts and task queries to its stated external service using a configured API key.
Install only if you intend to use the Seedance/AI Director external service, trust seedance25movie.coze.site with your prompts, public image URLs, task metadata, and API key, and are comfortable with credit-consuming generation. Configure only the AI_DIRECTOR_API_KEY secret and confirm before submitting paid generation jobs.
代码的核心行为与声明中的“生成视频、图生视频、生成图片、AI绘图”基本一致：提供 video 和 image 两个命令，分别调用远程接口 generate_video 与 text_to_image。视频部分支持 seedance-2.0、2.0-fast、1.5-pro 映射，也支持通过 image_url 实现图生视频；图片部分支持文生图。代码还会读取 API Key 环境变量并访问外部站点，这属于实现这些已声明能力所必需的支撑行为，不构成额外未声明风险。 但声明中还明确写了“积分查询与作品管理”“查积分、查余额、查看作品”等触发场景，而给出的代码片段完全没有查询余额/积分、列出作品、管理作品、查询任务列表等逻辑。因此描述包含了代码未体现的实质性能力，属于描述与实际行为不一致。
The skill explicitly instructs users to place an API key in mcp.json or environment variables, which indicates access to sensitive configuration material. In agent environments, references to reading configuration files and env vars are security-sensitive because poorly scoped scripts or prompts can lead to accidental exposure, misuse of the key for unauthorized API calls, or lateral access to other secrets in the same configuration context.
| 平台 | 配置方式 |
|------|---------|
| **OpenClaw/WorkBuddy** | 在mcp.json或环境变量中设置 `AI_DIRECTOR_API_KEY=avk_xxx` |
| **扣子Coze** | 安装技能后按提示填写API Key凭证 |
| **ClawHub** | 安装后配置环境变量 `AI_DIRECTOR_API_KEY` |
The skill declares execution prerequisites including environment-variable access and implies networked API usage, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the runtime authority unclear and can cause the agent platform to grant broader capabilities than users or reviewers expect, increasing the chance of unintended secret access or network use.
The trigger text is broad enough to match many ordinary requests about making videos or images, which can cause the skill to activate in contexts where the user did not intend to invoke an external paid service. In this skill, that risk is more significant because activation may consume credits, use a stored API key, and send user prompts or image URLs to a remote service.
The listed usage triggers are ambiguous and rely on generic phrases like '生成视频' or 'AI绘图', which overlap with common conversational requests that may only seek advice, brainstorming, or local editing help. Because this skill performs external API-backed generation, overbroad invocation can result in unintentional data disclosure to the provider and unwanted credit consumption.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
try:
response = requests.post(
f"{API_BASE}/api/mcp",
headers=headers,
json=payload,
The file’s user-facing description is written in Chinese, and later CLI help/output strings are also Chinese-only. This imposes a specific language on users without opt-in, which matches the language/locale policy violation category.
Multiple user-visible strings such as the API key error, command descriptions, and status messages are all presented only in Chinese. Because the skill does not provide a language choice or explain a justified locale restriction, this is a natural-language policy issue.
The script transmits a sensitive API key in an HTTP header to an external service and forwards user-supplied identifiers/queries off-host. External transmission is expected for this skill’s purpose, but it still creates real risk if the remote endpoint is compromised, misconfigured, or insufficiently trusted, since account data, work listings, and task metadata may be exposed.
}
try:
response = requests.post(
f"{API_BASE}/api/mcp",
headers=headers,
json=payload,