Seedance 2 Prompts Skill

• Outcome: Pass
• Latest audit: Jul 22, 2026 · 1:40 AM UTC
• Version: 0.1.0

Overview

This skill is a prompt-library helper that uses public HuggingFace data as disclosed, but users should be aware it runs install/update downloads and can process pasted content for prompt remixing.

Install this only if you are comfortable with an install script and later skill invocations contacting HuggingFace to download/update the public prompt library and preview images. Do not paste confidential articles, scripts, customer data, or private documents into remix mode unless your agent environment is approved to process that content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation requires network access (HuggingFace fetches, cover-image downloads, update checks) but does not declare that capability in its manifest. This creates a transparency and permission-boundary problem: a host may treat the skill as low-risk while it performs network operations during routine use.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as using a local prompt library, but its normal workflow silently performs remote freshness checks and may pull updated content before serving the user. That mismatch can surprise users and operators, expands the trust boundary to a remote dataset, and enables unreviewed content changes to affect behavior at runtime.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill directs the agent to execute shell commands to fetch remote files and write them into /tmp, then delete them, even though the core task is prompt recommendation. This unnecessarily expands the agent's execution surface and introduces risks from network retrieval, file handling, and shell/tool misuse beyond the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The documented behavior includes generating custom AI prompts when no library match exists, which exceeds the skill's stated role as a recommender. This is primarily a scope and disclosure issue: users and hosts may rely on the skill as a curated retrieval tool, while it can instead synthesize unvetted content.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The remix/personalization workflow turns the skill into a content transformation tool, not just a prompt recommender. While not inherently malicious, this broadens data handling and model behavior beyond what the manifest advertises, which can mislead users about how their provided content will be processed.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The example trigger phrases are very broad and overlap with normal user requests for media creation, which can cause the skill to activate in situations the user did not explicitly intend. In an agent environment, over-broad activation increases the chance of unnecessary data exposure to the skill context or unintended tool/workflow execution, even if the skill itself is not overtly malicious.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The remix-mode examples invite users to paste large bodies of article, script, or podcast content without clearly constraining scope, sensitivity, or consent. This can lead to unnecessary ingestion of proprietary, personal, or confidential content by the skill, especially because the examples make the workflow sound like a default and safe operation for arbitrary pasted material.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger examples are broad enough to overlap with normal conversation, which can cause the skill to activate unexpectedly and steer the assistant into using external prompt-recommendation behavior when the user did not clearly request it. In an agent ecosystem, ambiguous activation increases the risk of inappropriate context consumption, misrouting, and unintended influence over the assistant's response path.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: Stating that the skill will always provide English prompts imposes an output-language constraint without clear user consent, which can override user preferences or higher-level assistant policies. This is not a severe security issue, but in multi-skill or policy-sensitive environments it can lead to instruction conflicts and reduce user control over outputs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill mandates an automatic network freshness check before any other action and may silently fetch updates if data is older than 24 hours. Running outbound network activity without an in-context warning or consent is risky because it exposes metadata and changes behavior based on remote content before the user explicitly agrees.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The package executes code automatically during installation via the postinstall script, which is a security-sensitive behavior because users may trigger network access and code execution simply by installing the skill. Although the description mentions auto-download behavior, it does not clearly warn that npm install will run code, which reduces informed consent and increases supply-chain risk if the setup script is changed or abused.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.