Seedance Dreamina 即梦 CLI 视频生成下载工作流

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 2026.4.10-1

Overview

The skill is mostly coherent for using Dreamina, but its install instructions ask users or agents to execute an unverified remote shell script.

Install only if you trust the Dreamina CLI distribution endpoint and are comfortable running a remote installer with your user privileges. Prefer downloading and inspecting the installer first, using a pinned or signed release if available, and avoid running it from an elevated shell. Review commands before submitting generation jobs because they may use account credits.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.md:17

Finding

Unverified Remote Script Executed Directly by Shell

Content

View full analysis

Vulnerability Details

File Location: skill.md, line 17
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Complete Code Snippet:

bash

curl -fsSL https://jimeng.jianying.com/cli | bash

Technical Analysis

The installation instruction downloads a mutable script from an external URL and pipes it directly into bash. The script is executed without being saved for inspection, pinned to a specific version, or verified through a cryptographic signature or published checksum.

HTTPS provides transport protection but does not guarantee that the endpoint, its hosting infrastructure, or the script itself will remain trustworthy. Although the document describes this as the official installation method, the audited project contains no independent integrity information that would allow the retrieved payload to be verified. The effective code can also change after the Skill has been reviewed.

Direct arbitrary shell execution exceeds the minimum privileges needed for the Skill's declared function of operating an image and video generation CLI. The downloaded script inherits the privileges and environment of the user or Agent that executes the instruction.

Attack Path

1. An Agent or user follows the installation instruction in skill.md.
2. curl retrieves the current response from the external endpoint.
3. The response is streamed directly to bash without inspection or integrity verification.
4. If the endpoint, distribution infrastructure, DNS resolution, trusted delivery account, or hosted script is compromised, attacker-controlled shell commands execute immediately.
5. Those commands inherit the invoking process's user permissions and can access resources available to that account.

Impact Assessment

A malicious remote payload could read or modify files accessible to the invoking user, access environment variables and locally available credentials, alt ...[truncated 471 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the curl | bash pipeline with a version-pinned package or release artifact obtained from a documented official distribution channel.
2. Download the artifact to a local file without executing it automatically.
3. Verify a publisher-provided cryptographic signature or a SHA-256 checksum obtained through a separately trusted channel.
4. Allow the user or Agent to inspect the downloaded installer before execution.
5. Require explicit user consent before installation and clearly document the files, directories, network access, and configuration changes the installer performs.
6. Run installation with ordinary user privileges wherever possible and do not invoke or request sudo implicitly.
7. Prefer a package manager that supports version locking, provenance metadata, signature validation, and reproducible updates.
8. If a shell installer must be retained, pin an immutable, versioned URL and publish both its expected digest and a safe staged installation procedure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs agents to install software by piping a remote script directly into bash, which executes unreviewed network content immediately. If the server, transport, or published installer is compromised, an agent could run arbitrary shell commands with the user's privileges, making this especially dangerous in a skill meant to drive CLI usage.

Content

Scanner excerpt · skill.md (reported line 17)May include surrounding context.

2. 安装方式（官方）

bash

curl -fsSL https://jimeng.jianying.com/cli | bash

安装完成后，运行 dreamina -h 查看所有功能，并执行 dreamina login 完成登录授权。

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit shell chaining into bash turns remote content retrieval into immediate code execution, eliminating any review barrier. In agent contexts, this is more dangerous because an automated system may follow the instruction non-interactively, magnifying the risk of arbitrary command execution from a compromised or malicious installer endpoint.

Content

Scanner excerpt · skill.md (reported line 17)May include surrounding context.

2. 安装方式（官方）

bash

curl -fsSL https://jimeng.jianying.com/cli | bash

安装完成后，运行 dreamina -h 查看所有功能，并执行 dreamina login 完成登录授权。

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Line L021 explicitly maps the Chinese term "即梦" to Dreamina and directs the agent to use this skill when that term appears. This imposes a language-specific interpretation policy without indicating user opt-in or presenting it as an optional locale choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.