T09 · Insecure Skill Coding Practices
Error
- Location
seedance.py:215- Finding
Shell Command Injection Through the Download Path on macOS
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance Video
Security checks for vulnerabilities and agentic risk
Overview
This Seedance video skill mostly matches its stated purpose, but it has a real macOS command-injection bug and under-disclosed handling of uploads, downloads, credentials, and deletion actions.
Review this before installing. Use it only with non-sensitive prompts and images you are authorized to upload to Volcengine/ByteDance, avoid printing any part of ARK_API_KEY, choose download paths carefully, and do not rely on the macOS auto-open behavior until the os.system download-path bug is fixed. Treat delete actions as destructive and confirm the exact task ID before running them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:23- Finding
API Key Prefix Is Exposed in Command Output and Logs
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` Additional hardening should include: 1. Never print complete or partial API keys. 2. Avoid enabling shell tracing with `set -x` around credential-handling commands. 3. Redact authorization headers and secrets from Agent logs and exception output. 4. Document that credentials should be supplied through a protected environment or secret manager. 5. Rotate the key if logs containing its prefix were exposed beyond their intended audience. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (20)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md # Seedance curl API 参考 > 完整 curl 命令参考。日常使用推荐 Python CLI（`{baseDir}/seedance.py`），此文件仅供调试或 CLI 不可用时参考。
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md # Seedance curl API 参考 > 完整 curl 命令参考。日常使用推荐 Python CLI(`{baseDir}/seedance.py`),此文件仅供调试或 CLI 不可用时参考。
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash while true; do STATUS_RESULT=$(curl -s -X GET ".../tasks/${TASK_ID}" -H "Authorization: Bearer $ARK_API_KEY") STATUS=$(echo "$STATUS_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])") [ "$STATUS" = "succeeded" ] && break [ "$STATUS" = "failed" ] || [ "$STATUS" = "expired" ] && break
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The code invokes a shell via os.system() using a path derived from user-controlled input (
--download). Although the filename is generated, the parent directory can contain shell metacharacters or command substitution syntax, enabling command injection when the macOSopencommand is executed. In a CLI skill context that handles file downloads, this creates an avoidable local code-execution risk.- Content
python # Open on macOS if sys.platform == "darwin": os.system(f'open "{filepath}"') except Exception as e: print(f"Download failed: {e}", file=sys.stderr)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README instructs users to send prompts and potentially images/audio to ByteDance Seedance via the Volcengine Ark API, but it does not warn that this data leaves the local environment and is transmitted to a third-party service. This can lead users to unknowingly upload sensitive personal, proprietary, or regulated content, increasing privacy, confidentiality, and compliance risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell commands, accesses environment variables, and makes network-backed API calls, but it declares no explicit tool scope or permission boundaries. This increases the chance the agent can execute this skill in contexts where users did not clearly authorize command execution, external requests, or secret-dependent operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match many ordinary requests such as '做个视频' or '生成一段动画', which can cause the skill to activate unexpectedly. Because the skill can perform shell execution, network calls, and file downloads, overbroad activation raises the risk of unintended side effects from casual user prompts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill repeatedly instructs downloading generated media to
~/Desktop, creating local files without a clear user-facing warning or explicit consent at execution time. Silent or implicit writes to a prominent user directory can surprise users, overwrite expectations about where outputs go, and increase privacy or storage risk on shared systems.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documented
deleteoperation is destructive but is presented alongside routine task-management commands without a prominent warning or confirmation requirement. If triggered accidentally or by an ambiguous request, users may lose task history or the ability to retrieve generated assets.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains core operational instructions and evaluation details entirely in Chinese, which can effectively force a specific language on users. The policy allows locale constraints only when they are optional or clearly justified; no such opt-in or justification is present here.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This reference file documents making outbound requests to an external video-generation service, which entails transmission of user prompts, images, and authentication material outside the local trust boundary. In the context of an agent skill, that is expected behavior, but it still becomes a real security concern if not clearly disclosed and governed.
- Content
md # Seedance curl API 参考 > 完整 curl 命令参考。日常使用推荐 Python CLI（`{baseDir}/seedance.py`），此文件仅供调试或 CLI 不可用时参考。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples send authenticated requests containing prompts and potentially sensitive user content to a third-party API using an API key, but the reference does not warn users that their data and credentials are leaving the local environment. In a skill that may be used by non-experts, omission of disclosure and handling guidance increases the risk of accidental exposure of secrets or sensitive prompts/images.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The image-URL example causes user-supplied image references and prompts to be transmitted to the external API, creating potential privacy and data-governance risk. This is especially relevant for a media-generation skill because users may provide proprietary or personal visual content.
- Content
URL 图片：
bash curl -s -X POST "https://ark.cn-beijing.volces.com/api/v3/contents/generations/tasks" \ -H "Content-Type: application/json" -H "Authorization: Bearer $ARK_API_KEY" \ -d '{ "model": "doubao-seedance-1-5-pro-251215",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The local-image workflow instructs users to base64-encode a local file and embed it into the request body, but does not explicitly say that the full image contents will be uploaded to the external service. Users may incorrectly assume the operation is local preprocessing, leading to unintended disclosure of sensitive files or personal images.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill includes
listanddeleteoperations that exceed the stated scope focused on video generation and async status queries. This is primarily a capability-expansion issue: users or higher-level agents may be able to enumerate prior tasks or cancel/delete them unexpectedly, increasing the blast radius beyond the documented intent.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Local image paths are accepted and converted to data URLs for upload to a remote API without an explicit warning at the point of use. In an agent/skill setting, users may not realize that supplying a local path causes the entire file contents to leave the machine, creating a privacy and data-exfiltration concern if sensitive images are selected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code downloads remote video content to disk and may auto-open it on macOS without a strong upfront warning. This creates both privacy and safety concerns: disk writes occur as a side effect, and automatic opening crosses a trust boundary by invoking local applications on untrusted remote content.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill can automatically open a downloaded file in the local OS, which is outside the core purpose of generating videos. This increases risk because remote content is being fetched and then handed to the operating system without a clear consent boundary, potentially triggering unsafe handlers or user confusion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file uses Chinese throughout, including the title and all feature descriptions, but does not state that the skill is intended only for Chinese-speaking users or offer any language choice. Per the policy category, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This markdown file presents its substantive instructions and evaluation content in Chinese, but there is no indication that the user opted into that language or that the skill is intended only for a Chinese-speaking or region-specific context. That can violate language/locale policy requirements for user-facing skill content.
- Content
Static analysis
No suspicious patterns detected.