Seedance 2.0 Prompt Writing Guide (Chinese)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:35 PM UTC
• Version: 1.0.0

Overview

The skill itself is a coherent Chinese Seedance prompt-writing guide, but its optional unpinned npx installer can run mutable third-party code during installation.

The prompt-writing skill content is low risk, but prefer the manual copy installation path after inspecting the files. Avoid the unpinned npx installer in sensitive environments unless you verify the resolved package, version, and publisher first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Unpinned Third-Party CLI Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 23–25
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

bash

npx skills add dexhunter/seedance2-skill

Technical Analysis

The documented installation method invokes npx to retrieve and execute the third-party skills CLI without specifying a package version or integrity hash. The effective code executed by this command is therefore mutable and cannot be fully assessed from the files included in this project.

If the CLI package, its transitive dependencies, or the referenced skill package is compromised or changes unexpectedly, the installation command may execute attacker-controlled code. This behavior exceeds the minimum privileges required for a documentation-only prompt-writing skill because installation can involve executing external code rather than simply copying the reviewed SKILL.md file.

The audit did not establish that the current external package is malicious. The vulnerability is the unsafe, unpinned supply-chain trust model documented by the project.

Attack Path

1. An attacker compromises the unpinned skills package, one of its dependencies, its distribution account, or another mutable component resolved by the command.
2. A user follows the installation instructions and runs npx skills add dexhunter/seedance2-skill.
3. npx retrieves the currently resolved package version rather than a fixed, previously audited version.
4. Package initialization or CLI execution runs attacker-controlled code with the permissions of the invoking user.
5. That code may access or modify resources available to the user, including project files, agent configuration, skill directories, environment variables, and user-owned credentials.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user’s account. The resulting scope is limited by that account’s ...[truncated 475 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills CLI to an explicitly reviewed version, for example by using an exact package version rather than the latest registry resolution.
• Publish and verify a cryptographic integrity hash or signed release before execution.
• Document the expected package registry and package publisher so users can verify provenance.
• Audit and lock transitive dependencies where the package ecosystem supports lockfiles.
• Prefer a non-executable installation method that copies the reviewed SKILL.md into the appropriate skill directory.
• Correct the manual installation instructions so all referenced paths correspond to files actually included in the package.
• Advise users to inspect the resolved package and installation scripts before running the CLI, particularly in environments containing sensitive credentials.
• Run installation in a restricted environment with minimal filesystem access, no unnecessary secrets, and no elevated privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

克隆或下载本仓库，然后将技能文件复制到 Claude skills 目录：

bash

mkdir -p ~/.claude/skills

# 中文版
cp zh/SKILL.md ~/.claude/skills/seedance-prompt-zh.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

克隆或下载本仓库，然后将技能文件复制到 Claude skills 目录：

bash

mkdir -p ~/.claude/skills

# 中文版
cp zh/SKILL.md ~/.claude/skills/seedance-prompt-zh.md

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and the entire guidance content are written as if the skill operates only in Chinese, with no indication that users may request another language. This is a natural-language locale policy concern because the skill appears to impose a specific language by default rather than offering user choice or documenting a justified region-specific restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The primary README content is presented in Chinese while only a small link to an English version is provided. This can be interpreted as a language-default policy choice without explicit user opt-in or a clear statement that users may choose their preferred language.

Content

No source excerpt is available for this finding.