Seedance Prompt Architect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.1.0

Overview

The skill is mostly a coherent Seedance prompt-writing workflow, but its optional setup asks users to run an unpinned GitHub MCP package through npx, which expands local execution risk beyond the text-only skill.

The prompt-writing skill itself is usable as text-only. Before enabling the optional MCP, review the GitHub repository, prefer a pinned commit or verified release, and run it only in a restricted environment without sensitive files, credentials, or broad network access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:74

Finding

Unpinned Remote MCP Package Is Automatically Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74-80
Vulnerability Type: Remote payload retrieval and insecure dependency execution
Risk Level: Medium

Vulnerable Code:

bash

openclaw mcp add cdance \
  --command npx \
  --arg -y \
  --arg github:gpt-img-2/cdance-prompt-mcp \
  --include 'search_prompts,get_prompt,list_workflows,build_video_prompt_brief'

openclaw mcp doctor cdance --probe

Technical Analysis

The installation instructions configure OpenClaw to execute an npm package fetched directly from a mutable GitHub repository reference. The reference is not pinned to a reviewed commit hash or immutable, verified release. Consequently, the code executed by npx can change after the Skill has been audited.

The -y option suppresses the normal installation confirmation, reducing the opportunity for the user to inspect the resolved package and its source before execution. No integrity hash, signature verification, dependency lock file, or mandatory review step is provided.

Although the MCP integration is described as optional and read-only at the tool-interface level, its implementation still executes as a local process. A read-only MCP API does not prevent malicious package initialization code or compromised transitive dependencies from accessing resources available to the process. This execution is not necessary for the Skill's core text-only prompt-construction functionality and therefore expands the attack surface beyond minimum privilege.

Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or one of the package's dependencies.
2. The attacker modifies the repository's default branch or dependency resolution so that installation executes malicious code.
3. A user follows the documented command, which registers the mutable GitHub package for execution through npx -y.
4. When OpenClaw starts or probes the MCP server, npx r ...[truncated 1241 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the GitHub dependency to a reviewed, immutable commit hash rather than a mutable branch or default repository reference.
2. Prefer a signed, versioned release distributed through a trusted package registry with provenance information.
3. Verify package signatures or integrity hashes before installation and document the expected digest.
4. Remove the automatic -y confirmation option so users can review the resolved source and version before execution.
5. Audit and lock all transitive dependencies using a committed lock file.
6. Run the MCP server in a sandbox or container with:
   • No access to credentials or unrelated environment variables
   • Read-only or narrowly scoped filesystem access
   • Restricted outbound network access
   • No elevated operating-system privileges
7. Clearly document the exact data sent to external services and advise users not to include confidential creative briefs or sensitive reference information.
8. Keep the MCP integration disabled by default because the Skill's declared prompt-building workflow can operate without external executable tooling.
9. Provide reproducible build instructions and security review guidance for users who choose to enable the optional integration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- Demo: https://cdance.ai/seedance-2-0-video-generator
- Create: https://cdance.ai/create
- Prompt gallery: https://cdance.ai/prompts/seedance-2-0
- Raw SKILL.md: https://cdance.ai/skills/seedance-video-prompt-architect/SKILL.md
- Prompt examples: https://cdance.ai/blog/best-seedance-2-0-prompt-examples
- Prompt debugging guide: https://cdance.ai/blog/common-seedance-2-0-prompt-mistakes
- C Dance Prompt MCP: https://github.com/gpt-img-2/cdance-prompt-mcp

Static analysis

No suspicious patterns detected.