Security audit

Seedream

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it prominently encourages passing a paid API key on the command line, which can expose the credential in logs or shell history.

Review before installing. Use a dedicated, least-privileged Volcengine key, prefer VOLC_API_KEY or a managed secret store instead of --api-key, avoid sending private images as base64 unless intended, and be aware requests go to Volcengine's cn-beijing endpoint.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_image.py:57
Finding: API Credential Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/generate_image.py:2
Finding: Mutable Runtime Dependency Without Exact Version or Integrity Pinning
Content: View full analysis
=3.10" # dependencies = [ # "requests>=2.31.0", # ] # /// ``` ### Technical Analysis The script declares `requests>=2.31.0` rather than an exact, reviewed version and provides no lockfile or package hash. When the documented `uv run` workflow resolves dependencies, it may select a later compatible release that was not present during the audit. The dependency name is legitimate, and the audited project contains no evidence that the current `requests` package is malicious. The risk arises from mutable runtime resolution: future dependency versions or transitive dependencies can change without any modification to this project. A dependency imported by the script executes in the same Python process and security context as the Skill. It can therefore potentially access: - The Volcengine API key held in process memory. - Prompts and optional Base64 reference-image content. - Files and environment variables available to the invoking user. - The network access available to the Skill. This behavior exceeds the minimum predictable dependency surface because the Skill only requires a known HTTP client implementation, while the version constraint permits unreviewed future releases. ### Attack Path A viable exploitation path depends on compromise of the package distribution or dependency supply chain: 1. A user executes the script through `uv run`. 2. The resolver selects a newer `requests` release or transitive dependency allowed by the broad constraint. 3. The selected artifact has been compromised, maliciously replaced, or contains a newly introduced exploitable flaw. 4. The package is installed and imported into the Skill's process. 5. Malicious package code executes with the invoking user's privileges. 6. It can read in ...[truncated 760 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a Python script that uses both network access and sensitive configuration input (--api-key or VOLC_API_KEY), but the manifest does not declare any tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for the host to constrain or review what external access the skill actually requires, increasing the risk of unintended network use or secret exposure if the script is modified or abused.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/generate_image.py (reported line 38)May include surrounding context.
python
payload["sequential_image_generation"] = "disabled" try: response = requests.post(url, headers=headers, json=payload) response.raise_for_status() result = response.json()

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The code sends all requests to a cn-beijing endpoint, which imposes a specific regional routing choice in the skill's behavior. Under the language/locale policy category, region or locale constraints should be documented or user-selectable unless clearly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.