ClawHub
Back to skill

Security audit

Seedance AI Video Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill does generate Seedance videos, but it needs Review because its scripts can send the Ark API key to any configured endpoint and download unvalidated result files locally.

Install only if you trust the execution environment and keep ARK_API_URL pinned to the official HTTPS Ark endpoint. Use a limited Ark API key, avoid sensitive prompts or private media URLs, and review or patch the download script before using it in shared or important workspaces.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate_video.py:19
Finding

Configurable API endpoint can receive bearer credentials and sensitive generation data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/download_video.py:41
Finding

Untrusted result URLs are downloaded without destination or resource validation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/download_video.py:73
Finding

Unvalidated task ID can escape the output directory during result download

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tainted flow: 'req' from os.environ.get (line 30, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The request URL is built from the ARK_API_URL environment variable and then used in urllib.request.urlopen with an Authorization bearer token header. If an attacker can influence that environment variable, the script will send the API key to an arbitrary endpoint, causing credential exfiltration and potentially SSRF-style outbound requests. In this skill context, the script is intended to talk to a specific vendor API, so allowing the base URL to be overridden increases risk without much need for untrusted values.

Content

Scanner excerpt · scripts/download_video.py (reported line 36)May include surrounding context.

python
method="GET",
    )

    with urllib.request.urlopen(req) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tainted flow: 'req' from os.environ.get (line 59, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_video.py (reported line 69)May include surrounding context.

python
method="POST",
    )

    with urllib.request.urlopen(req) as resp:
        result = json.loads(resp.read().decode("utf-8"))
    return result

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/query_task.py (reported line 39)May include surrounding context.

python
method="GET",
    )

    with urllib.request.urlopen(req) as resp:
        result = json.loads(resp.read().decode("utf-8"))
    return result

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明的核心用途是“生成 AI 视频”，并强调多模态生成能力；但提供的代码块并未提交任何生成任务，也未处理文本、图片、音频或视频输入用于生成。它唯一执行的远程操作是调用 /api/v3/contents/generations/tasks/{task_id} 查询任务状态，并在完成时打印结果链接，或在失败时打印错误信息，还支持轮询。这属于视频生成工作流的辅助查询工具，而不是所声明的主能力本身。因此描述与该代码块实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation tells users to make media publicly accessible or upload it externally, but provides no warning about privacy, confidentiality, or data exposure. Encouraging public URLs for user-provided images, audio, or video can disclose sensitive content to third parties and may create lasting public availability beyond the user's expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents use of environment variables and outbound network/API access but does not declare any tool scope or permissions boundary. In an agent environment, missing explicit scope increases the chance of unintended capability use, weakens reviewability, and can lead to unauthorized access to secrets or external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description includes broad trigger phrases such as generic requests to 'make a video,' which can cause the skill to activate in routine conversations beyond the user's intent. Over-broad activation can unintentionally send prompts or media to external APIs, increasing the risk of data disclosure and surprise actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill metadata and documentation are entirely written in Chinese and present the workflow as Chinese-localized by default, without offering a language choice or documenting a justified locale-only scope. This can violate language/locale policy when users have not opted into a specific language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs downloading generated video files into the working directory without warning about local file creation, retention, or disk usage. This can lead to unintended storage of sensitive or copyrighted media, overwrite/cleanup issues, and surprises for users in shared or persistent workspaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The API reference instructs the skill to send user-provided prompts and externally hosted media URLs to a third-party video generation service, but it does not disclose that this transfers potentially sensitive user data off-platform. In a multimodal generation context, prompts, image URLs, video URLs, and audio URLs may contain personal, confidential, or copyrighted material, so the missing privacy notice can lead to unintentional data disclosure and compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown guide is written entirely in Chinese and presents all prompting instructions and examples in that language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language workflow. Under the policy for natural-language constraints, a language requirement without user opt-in or documented justification is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring presents the script name and usage entirely in Chinese, and the rest of the script continues with Chinese user-facing messages. For a general-purpose download utility, this imposes a language/locale choice on users without opt-in or a documented region-specific justification, which matches the language policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script sends user prompts and any referenced image/video/audio URLs to a third-party API, but it does not provide an explicit privacy or data-transmission warning at runtime. In this skill context, remote transmission is necessary for functionality, but users may unknowingly submit sensitive prompts or internal media links to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s user-facing description and usage instructions are presented only in Chinese, and the script continues this pattern in help text and runtime messages. This can violate a language/locale policy when a skill forces a specific language without offering the user an explicit choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

A language-specific presentation can violate natural-language policy when it effectively forces a locale without user opt-in or justification. This reference provides all instructions and field explanations only in Chinese, with no indication that the skill is region-specific or that another language option exists.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.