seaart video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its SeaArt video-generation purpose, but it includes unsafe token-checking guidance that can print a password-equivalent SeaArt session token into logs.

Review before installing. If used, do not run echo $SEAART_TOKEN; check token presence without printing it, keep the SeaArt cookie private, and understand that prompts, image URLs, and the token cookie are sent to seaart.ai.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:75

Finding

Authentication Token Disclosed Through Terminal Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:75
Vulnerability Type: Secret exposure through insecure environment-variable inspection
Risk Level: Medium

Vulnerable snippet:

markdown

First, check if the `SEAART_TOKEN` environment variable is set. You can do this by running a simple bash command: `echo $SEAART_TOKEN`.

Technical Analysis

The skill explicitly instructs the agent to execute echo $SEAART_TOKEN. This command prints the complete SeaArt session token to standard output instead of merely testing whether the variable is defined.

Agent tool output may be displayed in the conversation or retained in execution transcripts, CI logs, terminal recordings, debugging systems, or other monitoring infrastructure. Consequently, this instruction can disclose a credential that the same document identifies as password-equivalent. It also conflicts with the document's guidance not to expose the token in chat messages or logs.

Attack Path

1. A user configures a valid SeaArt session token in SEAART_TOKEN.
2. The agent follows the token-checking procedure in SKILL.md.
3. The agent runs echo $SEAART_TOKEN.
4. The complete token is written to visible or retained command output.
5. An attacker with access to the conversation, terminal transcript, execution log, or monitoring platform obtains the token.
6. The attacker supplies the stolen value as the SeaArt T authentication cookie and performs actions under the victim's SeaArt session, subject to the permissions and lifetime of that session.

Impact Assessment

Successful exploitation discloses the user's SeaArt session credential. An attacker may impersonate the affected SeaArt session and invoke account-accessible API operations until the token expires or is revoked. The scope is limited to the privileges associated with the compromised SeaArt account; no evidence indicates local privilege escalation or access to unrelated services ...[truncated 1 chars]

Remediation

View remediation

Remediation Suggestions

Replace the disclosure-prone command with a check that never prints the token value:

bash

if [ -n "${SEAART_TOKEN:-}" ]; then
    echo "SEAART_TOKEN is set"
else
    echo "SEAART_TOKEN is not set"
fi

Additionally:

• Explicitly prohibit printing, logging, or interpolating the token into diagnostic messages.
• Redact authentication cookies from HTTP debugging output and exception reports.
• Ensure agent and terminal logs do not retain secrets.
• Advise users to revoke and rotate the SeaArt token if it has previously been printed.
• Prefer a secret manager or protected credential facility over broadly inherited environment variables where supported.

T08 · Insecure Dependencies

Note

• Location: README.md:10

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:10
Vulnerability Type: Mutable third-party dependency installation without version or integrity constraints
Risk Level: Low

Vulnerable snippet:

markdown

- `requests` library (`pip install requests`)

Technical Analysis

The setup documentation instructs users to install requests without a pinned version or an integrity hash. Package resolution therefore depends on mutable package-index state at installation time, rather than a reviewed and reproducible dependency set.

This does not establish that the legitimate requests package is malicious. However, if the configured package index, package release process, resolver configuration, or network trust boundary is compromised, the installation may retrieve code different from the code reviewed for this skill. Python packages can execute code during installation and are subsequently imported by scripts/generate.py, giving a compromised dependency code execution within the user's Python environment.

Attack Path

1. A user follows the documented setup command pip install requests.
2. pip resolves the dependency from the user's configured package index without a required version or artifact hash.
3. An attacker compromises the relevant distribution channel, configured mirror, or a future package release.
4. The user installs the attacker-controlled artifact because no lock or hash validation rejects it.
5. Malicious code executes during package installation or when scripts/generate.py imports requests.
6. The code runs with the privileges of the user executing pip or the generation script and may access data available to that process, including SEAART_TOKEN.

Impact Assessment

In a successful supply-chain compromise, attacker-controlled Python code could run with the invoking user's privileges. It could read accessible files and environment variables, including the SeaArt tok ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

Use a reviewed, reproducible dependency definition rather than an unconstrained installation command:

• Add a requirements.txt or lock file containing an exact reviewed requests version and all transitive dependencies.

• Record trusted artifact hashes and install with:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Regenerate and review the lock file as part of a controlled dependency-update process.

• Install dependencies in an isolated virtual environment.

• Use the official Python Package Index over HTTPS or a controlled internal mirror.

• Avoid running package installation with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell commands, reads environment variables, and makes authenticated network requests, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch increases the chance the agent can use broader capabilities than a reviewer expects, including exposing a sensitive authentication token to shell or unintended commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation text is broad enough to trigger on generic requests like 'create a video' or 'generate a video,' which may cause the agent to invoke this skill in situations where the user did not specifically intend to use SeaArt or send content to an external service. In this skill, that is more sensitive because activation can lead to authenticated requests using a persisted token and disclosure of prompts or image URLs to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill hard-codes English via the accept-language: 'en' header and a lang='en' cookie. This is a natural-language/locale policy concern because users are not offered a language choice and the file does not justify why English must be enforced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.