Security audit

Seedance Video Generation BytePlus

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill mostly does what it says, but it includes an avoidable local command-execution risk when downloaded videos are opened on macOS.

Install only if you are comfortable sending prompts and chosen images to BytePlus and, if used, sending generated videos through Feishu. Avoid using sensitive images or confidential prompts, keep ARK_API_KEY scoped and rotated, and do not use the macOS auto-open download path until the helper replaces os.system with a non-shell file-opening call.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: seedance_byteplus.py:232
Finding: Shell Command Injection Through Unsanitized Download Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (35)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
## Execution (Recommended: Python CLI Tool) A Python CLI tool is provided at `~/.claude/skills/seedance-video-byteplus/seedance_byteplus.py` for robust execution with proper error handling, automatic polling, and local image base64 conversion. **Prefer using this tool over raw curl commands.** ### Quick Examples with Python CLI

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.
bash
echo "Waiting for video generation to complete..." while true; do STATUS_RESULT=$(curl -s -X GET "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks/${TASK_ID}" \ -H "Authorization: Bearer $ARK_API_KEY") STATUS=$(echo "$STATUS_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.
Query Task Status

bash
curl -s -X GET "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks/${TASK_ID}" \ -H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
bash
# List all tasks (paginated) curl -s -X GET "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks?page_num=1&page_size=10" \ -H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool # Filter by status

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
-H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool

Filter by status

curl -s -X GET "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks?page_num=1&page_size=10&filter.status=succeeded"
-H "Authorization: Bearer $ARK_API_KEY" | python3 -m json.tool

text

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
Cancel or Delete Task

bash
curl -s -X DELETE "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks/${TASK_ID}" \ -H "Authorization: Bearer $ARK_API_KEY"

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This section documents a workflow that sends file content and metadata to an external messaging platform, which matches an exfiltration pattern because local data is intentionally moved off-host. While the feature appears product-intended rather than covertly malicious, in an agent environment it is still security-relevant because it enables outbound transfer of generated or arbitrary local files to a remote recipient.
Content: Scanner excerpt · how_to_send_video_via_feishu_app.md (reported line 88)May include surrounding context.
[Video binary data]

text
**c) Send Message to Feishu Chat**

POST https://open.feishu.cn/open-apis/im/v1/messages/send

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatically opening a downloaded file on macOS performs a local side effect unrelated to the minimum needed for video generation. Even aside from the shell issue, auto-launching content from a remote URL can expose users to unsafe file handling or unexpected execution chains through associated applications.
Content: No source excerpt is available for this finding.

os.system() or os exec-family call

High

Category: Dangerous Code Execution
Confidence: 95% confidence
Finding: The code invokes a shell via os.system() using a path-derived string. Although the filename is internally constructed and task_id likely comes from the remote API, shell execution is unnecessary here and creates command-injection risk if the path or filename ever contains shell-significant characters or if future changes make filepath more user-controlled.
Content: Scanner excerpt · seedance_byteplus.py (reported line 242)May include surrounding context.
python
# Open on macOS if sys.platform == "darwin": os.system(f'open "{filepath}"') except Exception as e: print(f"Download failed: {e}", file=sys.stderr)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README repeatedly instructs users to submit prompts, local images, and task metadata to the BytePlus Ark API, but it does not prominently warn that this content is transmitted to a third-party service. In a skill that encourages use of personal/local files and natural-language prompts, that omission can lead users to disclose sensitive data without informed consent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 82% confidence
Finding: The README directs users to store a long-lived API key in the shell environment, which can persist for the session and may be exposed to subprocesses, shell history workflows, debugging output, or multi-user environments if handled carelessly. While common practice, it increases the blast radius of credential leakage for a third-party paid API.
Content: Scanner excerpt · README.md (reported line 20)May include surrounding context.
md
### 1. Get Your API Key Sign up at [BytePlus ModelArk Console](https://console.byteplus.com/ark/region:ark+ap-southeast-1/apiKey) and create an API Key. ### 2. Set Environment Variable

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 33)May include surrounding context.
Copy the skill folder to your Claude Code skills directory:

bash
mkdir -p ~/.claude/skills/seedance-video-byteplus # Copy SKILL.md and seedance_byteplus.py to the directory

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 69)May include surrounding context.
Generate a video from a text prompt with default settings (720p, 16:9, 5 seconds, with audio).

bash
python3 ~/.claude/skills/seedance-video-byteplus/seedance_byteplus.py create \ --prompt "A golden retriever running through a field of sunflowers at sunset, cinematic lighting" \ --wait --download ~/Desktop

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The curl example explicitly sends user prompts and authorization credentials to an external BytePlus endpoint, which is core functionality but still an external transmission risk. This becomes security-relevant because users may paste sensitive prompts or supply local/private images without a conspicuous warning about third-party transfer.
Content: Scanner excerpt · README.md (reported line 74)May include surrounding context.
--wait --download ~/Desktop

text
**curl equivalent:** ```bash curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool scope even though it clearly expects access to environment variables, shell execution, and outbound network calls. Missing scope boundaries can cause an agent platform to grant broader capabilities than necessary and makes risky behaviors less visible to users and reviewers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill does not clearly warn that prompts, task metadata, image URLs, and local image contents may be transmitted to BytePlus, nor that generated videos may be downloaded and opened locally. This creates a meaningful privacy and consent risk because users may provide sensitive prompts or files without understanding the external transfer and local execution side effects.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The skill is explicitly designed to send user prompts and possibly media to the external BytePlus API, so the transmission itself is expected. However, it remains a real security/privacy issue because the skill lacks strong disclosure and consent language around what data leaves the local environment.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
## Execution (Recommended: Python CLI Tool) A Python CLI tool is provided at `~/.claude/skills/seedance-video-byteplus/seedance_byteplus.py` for robust execution with proper error handling, automatic polling, and local image base64 conversion. **Prefer using this tool over raw curl commands.** ### Quick Examples with Python CLI

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The workflow encourages creating, waiting for, downloading, and storing generated videos locally, which creates session persistence and residual data on disk. While expected for a file-generation skill, this becomes risky when the skill does not clearly communicate retention, storage location, or cleanup expectations.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
Quick Examples with Python CLI

bash
# Text-to-video (create + wait + download) python3 ~/.claude/skills/seedance-video-byteplus/seedance_byteplus.py create --prompt "A kitten yawning at the camera" --wait --download ~/Desktop # Image-to-video from local file

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This example sends prompt text and an image URL to an external BytePlus endpoint. In context that is the core function of the skill, but it still exposes user-supplied data to a third party and therefore requires clear notice and constrained execution.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
With image URL:

bash
TASK_RESULT=$(curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This example converts a local image file to base64 and transmits the full file contents to the BytePlus API. That is more sensitive than a plain URL because it can exfiltrate local user data directly from disk to a third party if used on private images without informed consent.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
md
IMG_BASE64=$(base64 < "$IMG_PATH" | tr -d '\n') IMG_DATA_URL="data:image/${IMG_EXT_LOWER};base64,${IMG_BASE64}" TASK_RESULT=$(curl -s -X POST "https://ark.ap-southeast.bytepluses.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

SkillSpector

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

Query Task Status

External Script Fetching

External Script Fetching

Filter by status

External Script Fetching

Cancel or Delete Task

Exfiltration Commands

Context-Inappropriate Capability

os.system() or os exec-family call

Missing User Warnings

Session Persistence

Skill Enumeration

Session Persistence

External Transmission

Undeclared Tool Scope

Missing User Warnings

External Transmission

Session Persistence

Quick Examples with Python CLI

External Transmission

External Transmission

Static analysis