Security audit

seedance-ad-creative

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid Ofox video-generation helper with clear cost approval steps and no evidence of hidden persistence, exfiltration, or automatic privileged behavior.

Install only if you are comfortable sending product descriptions or images to Ofox and using an OFOX_API_KEY for paid generation. Review any npx installer command yourself, prefer a trusted or pinned install path when available, and make sure the agent shows a dry-run cost table and gets your explicit yes before any real run.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (16)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · CHANGELOG.md (reported line 839)May include surrounding context.
md
Rewrites the cost and delivery guidance around `ofox-video-core` 1.7.0's new `--dry-run`. Previously this skill told the agent to relay an estimate that the script only prints once the job is already billable — following it literally billed the user with no warning. - Cost flow is now: `--dry-run` to quote, wait for a yes, re-run without it. - **`--out-dir` in every example.** This skill never mentioned it, and the

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1230)May include surrounding context.
md
only its `SKILL.md` and `CHANGELOG.md`. If the probe found a core and a link

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The changelog recommends running npx skills add ofoxai/skills --skill ofox-video-core without pinning an exact package version. Unpinned npx execution fetches and runs whatever version is current at execution time, which can introduce supply-chain risk or unexpected behavior if the package changes or is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The file references npx ofox-skills as a distribution route without an exact version. Even in documentation, encouraging unpinned remote execution creates a reproducibility and supply-chain risk because different users may execute different code over time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: Another unpinned npx ofox-skills reference appears in recovery/install guidance. Because this skill ecosystem is intended for agents, even a documentation snippet can become executable advice, allowing remote code changes outside the working directory and broadening the impact of a compromised or changed package.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The changelog states npx ofox-skills installs the sibling skill but does not pin a version. In an agent-facing context, this is risky because npx may fetch and execute updated code at runtime, making installs non-reproducible and increasing supply-chain exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: This unpinned npx ofox-skills reference again provides executable installation guidance without version locking. Repeated occurrences increase the likelihood that an agent or user copies an unsafe install path, and the command may modify user-level agent configuration outside the current project.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The npx skills reference is another case of unpinned remote package execution. Because these commands can install or modify agent skills globally, compromise or drift in the upstream package could lead to arbitrary code execution or unwanted environment changes.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: seedance-ad-creative description: Requires OFOX_API_KEY — create one at https://app.ofox.ai. Generate a cinematic brand/product ad clip from a product description or photo using the Ofox video API (Seedance 2.5) — runs a short creative brief (product photo, brand tone, camera move, aspect ratio) when the request leaves them open, writes a timestamped shot-craft prompt (hook, showcase, slow-motion climax, hero close), shows a cost estimate, then calls ofox-video-core to submit, poll, download, and report the real cost. Use when a user asks for a commercial-style product or brand video, e.g. "give this perfume bottle a 10-second cinematic brand ad", "make a product ad for our new sneaker", "turn this product photo into a hero video for the landing page", or "I need a 15-second brand video with a slow orbit around the bottle". Do not use for dialogue-driven scenes with people talking (see seedance-short-drama). license: MIT version: "2.0.0" homepage: https://github.com/ofoxai/skills/tree/main/skills/seedance-ad-creative

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs use of npx ofox-skills without pinning a version or immutable package reference. That allows whatever package version is current at execution time to be fetched and run, creating a supply-chain risk where a compromised or malicious upstream release could execute arbitrary code in the user's environment.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 60% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
md
SCENE: <backdrop>, <one or two props framing the shot>, <light: saturated studio key with a warm rim | golden hour | single hard key>. 0–<3–5>s HOOK — <one visual focus: a macro of one ingredient | the cap | the clock face>; <one strong move: a hard cut lands as the detail completes its motion | low-angle dolly-in | a white flash freezes the frame | layers unfold>. (cases 12, 13, 15, 14) <TRANSITION between any two beats — name a kind; a hard cut is one of nine and an unnamed boundary becomes one: HARD CUT. | The camera plunges through <the gears / the pour / the open lid> into the next beat. (case 13) | <The product / the blade / a hand> sweeps past the lens and the camera comes out of the occlusion on <the next arrangement>. (the phrasing is cases 2, 8, 41, none of them ads) | A white flash freezes the frame, then <the next pose>. (case 15) | An extreme speed ramp carries <the event> into <the next beat>. (case 15) | Without cutting, <the array reassembles in frame>.> <>–<>s SHOWCASE — <arrangement: a strict geometric array of the variants | <tag> holds the product toward the lens, steam rising | the camera orbits the product 30 degrees>; cut to close-ups of <two or three details>. <one physical event in this beat — required, see slot notes> (cases 12, 14, 24) <>–<>s CLIMAX — <one physical event: the biscuit snaps | the broth erupts | the blade sweeps past the lens>; drops into slow motion for one second — <micro-detail: the filling bursts, crumbs fly, droplets hang> — then back to speed. (cases 12, 14, 15) [<>–<>s PAYOFF — <the event's result, as its own timed shot: the drop lands and one ring spreads and dies | the crumbs settle on the white>; full speed, and the landing named as a required visible event.] (only when the payoff is small and fast; job 60fbea52 wrote it as CLIMAX's tail and lost it, job cb6b7870 gave it its own stamp and got it — slot notes below)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 943)May include surrounding context.
md
| `minimax/hailuo-3` ("hailuo") | 768p, 8 cents/s — no 480p tier | 2k, uniquely among the three, at 13 cents/s | 4–15s — the shortest **maximum** of the three, so it's out for anything past 15s | 7, incl. 21:9 | **Accepted** the same two clips, 32 cents each (4s/768p, its minimum). Same caveat: two content classes tested, not a blanket clearance. | Price, max resolution, duration and aspect-ratio counts are catalog facts — `GET https://api.ofox.ai/v1/models/catalog`, no API key needed, publicly re-checkable any time — not results from a real generation. The moderation column is the one column here that came from a real, paid API call; treat it as evidence about exactly those two tested content classes on that date,

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The installation guidance references npx skills without a pinned version. Because npx may download and execute the latest package at runtime, a compromised release or dependency can result in arbitrary code execution during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line again tells users to run npx ofox-skills without version pinning, exposing them to mutable remote code execution. In a skill file, such installer instructions are especially sensitive because users may copy-paste them directly with elevated trust.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill repeats an unpinned npx ofox-skills invocation, which is a classic software supply-chain hazard. An attacker controlling the package, its dependencies, or the user's package resolution path could cause arbitrary code execution when the command is run.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 1323)May include surrounding context.
md
| Exit `2` | `curl`/`jq` missing, or `OFOX_API_KEY` not set | Re-run `ofox-video-core`'s `check` and follow its install/signup guidance | | Exit `3`, `error.code: insufficient_credits` | Ofox balance too low, especially likely at 1080p | No charge was made; suggest a cheaper 720p draft or adding credits at `https://app.ofox.ai` | | Exit `3`, `error.code: input_moderation_failed` on an image-to-video job | The reference frame contains a photoreal person — refused at submission on Seedance 2.5, nothing billed | Describe the person in text and lock only the product to the image; or crop the person out of the reference | | Exit `3`, job ends `failed`, or `invalid_request` on create, with no other error code hint | Likely a moderation rejection: prompts referencing a real celebrity/spokesperson likeness without consent, another brand's trademarked logo, or copyrighted characters are commonly rejected | Remove the flagged real-person/trademark/copyrighted reference from the prompt (or reference image), then call `generate` again — this is a **new** request, not a resubmission of the failed one, so it's safe to retry immediately | | Exit `3`, job ends `failed`, `error.code: output_moderation_failed` | The generated **output** failed a post-generation content check — happens after the job ran, not at submission. Not billed (no `usage` field on the response) | Retry with a brand-new `generate` call using a different prompt or reference image — a new request, not a resubmission of the failed one, so it's safe | | Exit `3`, job ends `failed`, `error.code: output_moderation_failed`, upstream message mentions **audio** copyright | The AUDIO block asked the model to generate music — measured on job `1ff72400-0f30-4be1-a417-f52d43955d09` with a cello note and a bell chime. Not billed | Rewrite AUDIO as room tone plus recorded sounds only, add the music words to AVOID, and re-run — a new request, safe immediately. See "4. No dialogue, no music — but a sound block" | | A real person ...[truncated 25 chars]

Static analysis

No suspicious patterns detected.