doubao-seedream-skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:19 AM UTC
• Version: 1.0.2

Overview

This is a plausible Seedream image-generation skill, but it needs Review because reference-image paths can cause any readable local file to be uploaded and generated-image downloads are not constrained.

Review this skill before installing if you work with private files or sensitive prompts. Use it only with a Volcengine API key you intend to use for Seedream, avoid passing local paths unless you are certain the file is a non-sensitive image, and be aware that prompts, reference images, URLs, and optional web_search requests are sent to an external provider. Generated images are downloaded automatically by default.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: seedream_api.py:40

Finding

Unrestricted Local File Encoding and External Upload

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: seedream_api.py:150

Finding

Unvalidated Response URL Download with No Resource Limits

Content

View full analysis

:"/\|?*') filepath = os.path.join(output_dir, filename) img_response = requests.get(url) with open(filepath, "wb") as f: f.write(img_response.content) local_paths.append(filepath) print(f"已保存: {filepath}") ``` ### Technical Analysis The code trusts every URL returned in the API response and automatically passes it to `requests.get()`. It does not validate: - The URL scheme. - The destination hostname. - Resolved public IP addresses. - Redirect destinations. - HTTP response status. - Response content type. - Whether the response is a valid image. - Content length or actual downloaded byte count. No connection or read timeout is configured. The use of `img_response.content` buffers the complete response in memory before writing it, and there is no maximum download size. Under ordinary operation, downloading generated images is necessary for the declared functionality. The risk arises because the remote API response controls the request destination. If the upstream service, response path, or returned URL is compromised, the client can be directed to internal services or arbitrarily large resources. ### Attack Path 1. The Skill submits an image-generation request to the configured API. 2. The API, a compromised upstream component, or another party capable of influencing the response returns an attacker-selected URL in `data[].url`. 3. The URL poi ...[truncated 1229 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'headers' from os.getenv (line 116, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · seedream_api.py (reported line 146)May include surrounding context.

python

if tools:
        data["tools"] = tools
    
    response = requests.post(API_URL, headers=headers, json=data)
    result = response.json()
    
    if "data" in result:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to send prompts to the Volcengine Seedream API but does not clearly warn that all prompt content will be transmitted to an external third-party service. Users may unknowingly submit sensitive, proprietary, or personal data in prompts, creating a privacy and data-governance risk. In an agent skill context, this omission is more dangerous because prompts may be composed from broader user context rather than only explicit user text.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill declares access to environment variables and makes outbound network requests, but it does not define any explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent runtime will grant broader capabilities than intended, making secret access and external transmission less visible to policy enforcement and reviewers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says the skill should be used whenever a user needs image generation, which is broad enough to auto-trigger on many ordinary requests without clear consent or boundary checks. In a skill that can read secrets and perform network actions, overbroad routing increases the risk of unnecessary invocation, unintended data transmission, and policy bypass through ambiguous prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger example '用户说"生成一张xxx图片"时，直接运行' is very generic and instructs direct execution without qualification or safety gating. Because the skill performs external API calls and may process local paths or URLs, such broad examples make accidental or manipulated invocation more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The code sends user-supplied prompt data and potentially image references to an external API endpoint, which is an external transmission of possibly sensitive data. In this skill's context, outbound transmission is expected for functionality, but it still creates privacy and data-handling risk if users provide confidential prompts, local file content, or internal URLs.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

"size": "2048x2048"
}

response = requests.post(API_URL, headers=headers, json=data)
result = response.json()

if "data" in result:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill exposes a generic tools parameter and explicitly supports capabilities like web_search, even though the skill's stated purpose is image generation. This broadens the remote capability surface and allows user-supplied requests to trigger external data retrieval unrelated to the declared scope, increasing privacy and policy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

If image is provided as a local path, the code base64-encodes the file and sends it to the remote Seedream API without an explicit warning or consent step at the call site. In a skill context, this can lead to accidental disclosure of local or sensitive images to a third-party provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · seedream_api.py (reported line 146)May include surrounding context.

python

if tools:
        data["tools"] = tools
    
    response = requests.post(API_URL, headers=headers, json=data)
    result = response.json()
    
    if "data" in result:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The CLI advertises and forwards web-search functionality (--tools) that is outside the narrow purpose of generating images. This can cause unexpected outbound network use and data sharing, especially when prompts or related context are sent to a third-party service with auxiliary tools enabled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

All user-facing instructions and examples in the README are presented only in Chinese, with no indication that another language is supported or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level natural-language documentation is written only in Chinese, which imposes a specific language without any opt-in or alternative. Under the policy, language-specific instructions should either offer a choice or clearly justify the locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.