Security audit

seedance

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended to generate AI videos, but its automatic runtime bootstrapping can download and execute installer code and install unpinned packages before use.

Review this before installing if your environment does not allow runtime package installation or network bootstrapping. Use it only with prompts and images you are willing to send to Volcengine/Ark and Alibaba OSS, avoid storing live keys in the skill .env unless acceptable for your machine, and prefer a prebuilt or locked environment with pinned dependencies and no get-pip fallback.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill metadata exposes powerful capabilities through allowed tools and documented behavior: it reads environment secrets, reads and writes files (.env, local images, saved videos), creates a virtualenv, installs dependencies, and performs network requests to external APIs and OSS. If the platform relies on declared permissions for review or containment, this mismatch can lead to under-scoped approval and unexpected secret exposure or file/network side effects.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The wrapper fetches get-pip.py from the network and immediately executes it, which is remote code execution during skill startup. Even if intended as a convenience fallback, this gives a network path code-execution capability unrelated to the core video-generation function and creates supply-chain and MITM risk if the retrieved bootstrap is compromised.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The wrapper performs runtime pip installation from requirements.txt on execution, which expands the skill's behavior from video generation to arbitrary package retrieval and install. This introduces supply-chain risk, permits unexpected code execution from dependency install hooks, and makes behavior depend on mutable external package sources at run time.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README states the skill triggers when you ask to "generate a video," which is a broad everyday phrase rather than a narrowly scoped invocation. In an agent runtime, this can cause unintended activation on generic user requests, increasing the chance the skill runs in contexts the user did not intend and potentially causing unnecessary external API calls, data transmission, or quota consumption.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The description says to use the skill when the user asks to "generate a video," which is broad enough to catch many unrelated video tasks. Over-broad activation can cause the agent to invoke a networked, quota-consuming skill unexpectedly, potentially sending user prompts or local media to third-party services without sufficiently specific user intent.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The "When to use" section repeats vague activation conditions like "generate a video" and "produce AI video from text, an image, or first/last frames," which can still match ambiguous requests. In this skill's context, that is more dangerous because execution triggers network calls, possible local file upload to OSS, and paid API usage after only a loose routing decision.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script only emits a low-visibility status message before downloading and executing get-pip.py, so users/operators may not realize network-fetched code will run. In a skill wrapper context, silent or near-silent remote bootstrap increases the chance that risky behavior occurs without informed approval or security review.

Unpinned Dependencies

Low

Category: Supply Chain
Content: alibabacloud_oss_v2>=1.3.2
Confidence: 94% confidence
Finding: alibabacloud_oss_v2>=1.3.2

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/test_seedance.py:327

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/seedance.py:253