Security audit

seedance2-script-create-yima

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-based advertising prompt skill with no automatic code execution, though its optional utility docs should be treated carefully.

Install only if you want a Chinese-language advertising prompt workflow. Do not run the optional pip install commands or utility examples unless you first add or verify the referenced scripts and install dependencies in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Warning

Location: utils/compliance_checker.md:76
Finding: Unpinned Dependencies in Compliance Checker Installation Instructions
Content: View full analysis
Vulnerability Details

File Location: utils/compliance_checker.md:76-78
Vulnerability Type: Unpinned third-party Python dependencies
Risk Level: Medium

Complete Code Snippet:

bash
pip install jieba opencc-python-reimplemented

Technical Analysis

The installation command resolves packages from the user's configured Python package index without exact version constraints, integrity hashes, a lock file, or repository verification. Package resolution can therefore produce different code at different times.

The project does not include the referenced compliance_checker.py implementation, so installing these dependencies does not produce a functional bundled utility. This makes the supply-chain exposure unnecessary for the Skill's documented advertising-prompt functionality.

Python package installation may execute package build logic, while later imports execute installed package code. A compromised package release, transitive dependency, package index, or index configuration could therefore introduce attacker-controlled code.

Attack Path

A user follows the utility documentation and runs the provided command.

pip queries the user's configured package index and resolves the latest compatible package versions and transitive dependencies.

An attacker compromises a resolved release, dependency, or package-index path.

Malicious package code executes during installation, build processing, or a subsequent import.

The code operates with the privileges and filesystem/network access of the user running pip or Python.

Impact Assessment

Successful exploitation could execute arbitrary code under the invoking user's account. This may permit access to that user's files, environment variables, credentials available to the process, and network resources. If the command is run in a privileged environment, the impact expands to those privileges. No evidence indicates that installatio ...[truncated 78 chars]
Remediation: View remediation
Remediation Suggestions

Remove the installation instructions unless the corresponding audited utility implementation is added to the repository.

Pin every direct and transitive dependency to reviewed versions.

Distribute a lock file or hash-verified requirements file, using --require-hashes.

Require installation inside a dedicated, non-privileged virtual environment.

Document the expected package index and prohibit untrusted extra indexes.

Add automated dependency vulnerability, provenance, and integrity scanning.

T08 · Insecure Dependencies

Warning

Location: utils/reference_integrity.md:99
Finding: Unpinned Dependencies in Reference Integrity Utility Instructions
Content: View full analysis
Vulnerability Details

File Location: utils/reference_integrity.md:99-100
Vulnerability Type: Unpinned third-party Python dependency
Risk Level: Medium

Complete Code Snippet:

bash
pip install networkx

Technical Analysis

The command installs a mutable package version from the user's configured Python package index without a version pin, integrity hash, lock file, or provenance check. Its transitive dependency set may also change without repository review.

The documented reference_integrity.py utility is not included in the project. Consequently, the dependency installation is not necessary to operate any bundled implementation and exceeds the minimum requirements of this documentation-based advertising Skill.

A malicious or compromised package artifact can execute code during build or installation processing, or when imported by Python.

Attack Path

A user attempts to use the documented integrity checker.

The user runs the unpinned installation command.

pip resolves a package artifact through the configured index.

A compromised release, dependency, or index supplies attacker-controlled code.

The code executes during installation or later import with the invoking user's privileges.

Impact Assessment

Exploitation could provide arbitrary code execution within the invoking user's security context, including access to readable project files, user data, environment variables, and reachable network services. The command is documentation-driven and is not automatically executed by the Skill.
Remediation: View remediation
Remediation Suggestions

Remove dependency installation guidance for utilities that are not shipped.

If the utility is added, pin reviewed direct and transitive versions in a lock file.

Require cryptographic hashes for downloaded artifacts.

Run installation and validation in an isolated, non-privileged environment.

Restrict resolution to an explicitly trusted package index.

Add dependency update review and automated supply-chain scanning.

T08 · Insecure Dependencies

Warning

Location: utils/script_generator.md:141
Finding: Unpinned Template-Engine Dependencies in Script Generator Instructions
Content: View full analysis
Vulnerability Details

File Location: utils/script_generator.md:141-143
Vulnerability Type: Unpinned third-party Python dependencies
Risk Level: Medium

Complete Code Snippet:

bash
pip install Jinja2 PyYAML

Technical Analysis

The documented command retrieves unconstrained versions of Jinja2, PyYAML, and their resolved dependencies. It provides no integrity hashes, lock file, trusted-index restriction, or isolated-environment requirement.

The repository does not contain the referenced script_generator.py implementation. The command therefore creates supply-chain exposure without enabling a bundled feature. Package build hooks or imported package code could execute attacker-controlled logic if an artifact or dependency were compromised.

Attack Path

A user follows the script-generator documentation.

The user runs the provided pip install command.

The configured index resolves mutable package versions and dependencies.

An attacker-controlled or compromised artifact is selected.

Malicious code runs during package processing or subsequent utility import.

Execution occurs with the invoking user's permissions.

Impact Assessment

A successful attack could result in arbitrary user-level code execution and access to files, environment variables, local credentials exposed to the process, and network resources. Running the command with administrative privileges would increase the potential impact. No evidence shows automatic installation or an existing malicious artifact in this project.
Remediation: View remediation
Remediation Suggestions

Delete the command if the script generator remains absent.

If an implementation is supplied, use an audited and hash-locked dependency manifest.

Pin direct and transitive package versions.

Require a dedicated virtual environment under a non-privileged account.

Use only a documented trusted index and disable untrusted extra indexes.

Scan packages and generated lock files for known vulnerabilities and provenance issues.

T08 · Insecure Dependencies

Warning

Location: utils/template_validator.md:97
Finding: Unpinned Validation Dependencies in Template Validator Instructions
Content: View full analysis
Vulnerability Details

File Location: utils/template_validator.md:97-99
Vulnerability Type: Unpinned third-party Python dependencies
Risk Level: Medium

Complete Code Snippet:

bash
pip install PyYAML jsonschema

Technical Analysis

This installation command accepts whatever compatible package releases and transitive dependencies are available through the user's configured Python package index. It lacks exact version pins, integrity hashes, a reviewed lock file, and index restrictions.

The documented template_validator.py file is absent from the project. Users are thus instructed to install third-party code for a utility that cannot be run as documented. This is unnecessary for the Skill's core prompt-generation behavior and increases supply-chain attack exposure.

Attack Path

A user attempts to configure the documented validator.

The user executes the unpinned installation command.

pip obtains mutable artifacts from its configured index.

A compromised package version, transitive dependency, or index response supplies malicious code.

The code executes during installation or later import with the user's permissions.

Impact Assessment

Exploitation could enable arbitrary code execution in the invoking user's context, potentially exposing readable files, environment secrets, development credentials, and accessible network services. The risk requires the user to manually execute the command; the audited Skill does not automatically install these packages.
Remediation: View remediation
Remediation Suggestions

Remove installation directions for the missing validator.

If the validator is added, publish exact reviewed versions and transitive resolutions.

Require hash verification and use a reproducible lock file.

Install only in an isolated, non-privileged virtual environment.

Restrict package retrieval to an explicitly trusted index.

Add automated dependency integrity and vulnerability checks to release review.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (113)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/auto_vehicle.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/beauty_skincare.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/electronics_auto.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/electronics_mobile.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/fashion_apparel.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/fashion_home.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/fmcg_beauty.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/fmcg_daily.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/fmcg_food.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/food_beverage.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/health_device.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/home_furniture.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/maternity_baby.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/pet_food.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/pet_services.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/realestate_residential.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/service_food.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/special_industries.md (reported line 1)May include surrounding context.
md
# 特殊行业广告示例（需强制标注�? ## 示例1：保健食品广告（蛋白粉，15秒） ### 用户需�?"帮我生成一个蛋白粉的广告视频，15�?

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language instructions and usage guidance are presented entirely in Chinese, which effectively forces a specific language for users reading or operating the skill. There is no opt-in, multilingual alternative, or justification that this skill is intentionally restricted to a Chinese-language or China-specific audience.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README shows a very broad natural-language activation example that could cause the skill to trigger on loosely related product requests without clear scoping, consent, or invocation boundaries. In an agent environment, ambiguous triggering can lead to unexpected behavior, accidental use of the skill in the wrong context, and bypass of user intent separation, even though this file does not itself contain code execution or prompt-injection text.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description says it should auto-activate for a wide set of common marketing and promotion terms, which creates a high chance of triggering in ordinary conversation that is not actually requesting this specialized behavior. In an agent setting, overly broad activation can cause unintended context capture, irrelevant instruction injection, or accidental override of a more appropriate skill, especially when the skill generates persuasive commercial content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The keyword-based activation logic relies on ambiguous phrases like marketing, promotion, or product video without defining when the skill must not activate. This can make the agent invoke the skill during benign or unrelated discussion, increasing the chance of prompt misrouting, unwanted behavior, and disclosure or transformation of user input into ad-generation workflows the user did not request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction "所有提示词使用中文" forces a specific language for all outputs. Under the policy, language constraints should either be optional for the user or clearly justified as a documented region-specific requirement; this line does not provide user opt-in and the stated platform requirement is not framed as a user-selectable constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown skill demonstrates prompts, user requests, and outputs only in Chinese, which can amount to forcing a specific language without user opt-in. The file does not state that the skill is region-specific or that users may choose another language, so it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown skill example forces a specific language/locale for all prompts and outputs, and there is no indication that users can opt into another language. Under the policy, language constraints should either be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Natural-Language Policy Violations

Vague Triggers

Vague Triggers

Vague Triggers

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis