Seedream 5.0 Lite image generation

• Analyzed: May 11, 2026, 6:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0887d0b13c96040cc712677010ff1cf0a77d6d8770319725353df08a7ea8753a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle facilitates image generation and editing via the PoYo API (api.poyo.ai). It includes a shell script, `scripts/submit_seedream_5_0_lite.sh`, which uses `curl` for network access and `cat` to read payload files provided as command-line arguments. While these capabilities are plausibly necessary for the stated purpose, the script lacks any validation or sanitization of the file path argument, which could allow for arbitrary file read and exfiltration if the AI agent is targeted by prompt injection. Per the provided criteria, these risky capabilities without clear malicious intent are classified as suspicious.