Seedance2 Gen Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it handles local environment files too broadly for a video-generation helper.

Install only if you are comfortable using Volcengine for video generation. Use a dedicated environment containing only ARK_API_KEY, avoid shared .env files with unrelated secrets, consider pinning the Volcengine SDK version, and do not submit private prompts or media URLs unless you intend to send them to that service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Third-Party SDK Installation Creates Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

' ``` 2. Maintain a dependency lock file generated from reviewed dependencies and include cryptographic hashes. 3. Install with hash verification, such as: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Explicitly configure the trusted Python package index rather than relying on ambient `pip` configuration. 5. Install the dependency in a dedicated, non-privileged virtual environment. 6. Add automated dependency vulnerability and provenance scanning to the release process. 7. Re-audit the SDK before updating the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gen_video.py:17

Finding

Overbroad .env Loading Exposes Unrelated Secrets to Imported Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The script reads environment variables and also auto-loads a .env file, but the capability is not declared in permissions. In an agent/skill context, undeclared access to local configuration and secrets breaks least-privilege expectations and can expose credentials available in the runtime environment.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The helper intentionally searches for and loads a .env file from the script directory and its parent, which is credential access behavior. While common in developer tooling, in a skill execution environment this can unintentionally ingest secrets from nearby project directories that the skill was not meant to read.

Content

Scanner excerpt · scripts/gen_video.py (reported line 19)May include surrounding context.

python

def load_dotenv():
    """Load environment variables from .env file (script directory first, then parent directory). Does not override existing environment variables."""
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Including a .env candidate in the script directory contributes to local secret harvesting behavior. If an attacker can influence placement of files or the execution context, the skill may consume unintended credentials without explicit user awareness.

Content

Scanner excerpt · scripts/gen_video.py (reported line 22)May include surrounding context.

python

"""Load environment variables from .env file (script directory first, then parent directory). Does not override existing environment variables."""
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for path in candidates:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Searching the parent directory for a .env file is especially risky because it broadens the trust boundary beyond the skill's own folder. In shared repositories or agent workspaces, this can capture unrelated secrets from a higher-level project directory, making accidental secret exposure more likely.

Content

Scanner excerpt · scripts/gen_video.py (reported line 23)May include surrounding context.

python

script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for path in candidates:
        path = os.path.normpath(path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_video.py (reported line 182)May include surrounding context.

python

api_key = os.environ.get("ARK_API_KEY")
    if not api_key:
        print("Error: ARK_API_KEY is not set, please configure it in the .env file or as an environment variable:", file=sys.stderr)
        print("  ARK_API_KEY=your_api_key", file=sys.stderr)
        sys.exit(1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation description is broad enough to trigger on generic requests to generate, edit, or extend videos, not just explicit requests to use this provider. That increases the chance the agent routes user content, prompts, and asset URLs to a third-party API without sufficiently specific user intent or provider-aware consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description does not clearly warn that prompts and reference asset URLs are transmitted to an external Volcengine API. In this skill, users may provide sensitive media URLs, audio, or descriptive prompts, so missing this disclosure can cause unintended third-party sharing of potentially private content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.