T01 · Skill Instruction Hijacking
Error
- Location
scripts/lib/seedance-2-video.mjs:565- Finding
Remote Manifest Can Supply a Mandatory Arbitrary Update Command
- Content
View full analysis
controller.abort(), timeoutMs) : null; try { response = await fetchImpl(manifestUrl, { headers: { Accept: "application/json" }, signal: controller?.signal, }); } catch { return { status: "skipped" }; } finally { if (timer) clearTimeout(timer); } if (!response?.ok) return { status: "skipped" }; let manifest; try { manifest = await response.json(); } catch { return { status: "skipped" }; } const skill = Array.isArray(manifest.skills) ? manifest.skills.find((entry) => entry?.id === skillId) : null; const policy = skill?.updatePolicy; if (!policy) return { status: "current" }; const minimumVersion = policy.minimumVersion || skill.version || currentVersion; const latestVersion = policy.latestVersion || skill.version || minimumVersion; const updateCommand = policy.updateCommand || "npx -y github:HiAPIAI/hiapi-seedance-2-0-video-skill -y"; if (compareVersions(currentVersion, minimumVersion) < 0) { return { status: "required", message: [ policy.requiredNotice || "This HiAPI skill version is no longer compatible with the current HiAPI API.", ...[truncated 3197 chars]- Remediation
View remediation