Security audit

seedance-product-video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid Ofox product-video integration, with clear cost-approval guidance and no evidence of hidden persistence, deception, or unrelated access.

Before installing, confirm you are comfortable sending product images, prompts, and related job data to Ofox and paying for generation after approval. Install or update ofox-video-core only from a source you trust, review the quoted cost before approving, and avoid using this skill for people/dialogue workflows despite the included research notes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence

Findings (17)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · CHANGELOG.md (reported line 1155)May include surrounding context.
md
Rewrites the cost and delivery guidance around `ofox-video-core` 1.7.0's new `--dry-run`. Previously this skill told the agent to relay an estimate that the script only prints once the job is already billable — following it literally billed the user with no warning. - Cost flow is now: `--dry-run` to quote, wait for a yes, re-run without it. - **`--out-dir` in every example.** This skill never mentioned it, and the

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1734)May include surrounding context.
md
packages only its `SKILL.md` and `CHANGELOG.md`, so `prompt-structure.md`,

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: seedance-product-video description: Requires OFOX_API_KEY — create one at https://app.ofox.ai. Generate a clean, catalog-style e-commerce product video from a real product photo (or, for a generic or fictional product, a text description) using the Ofox video API (Seedance 2.5) — runs a short creative brief (product photo, target platform and aspect ratio, background, camera orbit or turntable) when the request leaves them open, writes a plain-background, literal-accuracy prompt (precise product description, a simple camera orbit or turntable motion, no dramatic cinematography), shows a cost estimate, then calls ofox-video-core to submit, poll, download, and report the real cost. Use when a user asks to turn a product photo into catalog/listing footage, e.g. "make this product photo a 360-degree white-background showcase", "turn this photo into a white-background product video", "make a clean turntable video of this item", or "give me a 5-second white-background rotation video of this product for my listing". Do not use for cinematic brand/mood advertising (see seedance-ad-creative) or for anything involving people/dialogue (see seedance-short-drama). license: MIT version: "2.0.0" homepage: https://github.com/ofoxai/skills/tree/main/skills/seedance-product-video

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description at L0003 and the 'When NOT to use' section say this skill is for product-only clips and excludes people/dialogue. However, the file's own documented behavior includes using this skill's execution layer to create a 30-second presenter-led video with spoken lines, audio enabled, and a generated first frame, showing the skill can be used outside its advertised scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: A catalog product-video skill does not need instructions for enabling audio, handling a presenter on camera, or discussing real-person moderation bypass conditions for spoken presenter clips. Those capabilities belong to a different scenario and are expressly excluded by the manifest, making their inclusion context-inappropriate here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The markdown states that clip D's prompt was written in Chinese and later notes four spoken Chinese lines, but does not frame this as a user-selected language or a locale-specific constraint. Under the policy rule, documenting a language-specific behavior without opt-in can normalize a fixed-language path that conflicts with language/locale choice expectations.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This skill is explicitly designed to send user-supplied product photos, prompts, and related metadata to a third-party service at api.ofox.ai for generation. That external transmission can expose proprietary product imagery, unpublished SKUs, logos, and business-sensitive creative inputs to an external processor, so it is a real data-exposure risk even though it is expected functionality.
Content: Scanner excerpt · SKILL.md (reported line 1459)May include surrounding context.
md
| `minimax/hailuo-3` ("hailuo") | 768p, 8 cents/s — no 480p tier | 2k, uniquely among the three, at 13 cents/s | 4–15s — the shortest **maximum** of the three, exactly at this skill's segmented-template ceiling and below its out-of-scope 30s presenter clip | 7, incl. 21:9 | **Accepted** the same two clips, 32 cents each (4s/768p, its minimum). Same caveat: two content classes tested, not a blanket clearance. | Price, max resolution, duration and aspect-ratio counts are catalog facts — `GET https://api.ofox.ai/v1/models/catalog`, no API key needed, publicly re-checkable any time — not results from a real generation. The moderation column is the one column here that came from a real, paid API call; treat it as evidence about exactly those two tested content classes on that date,

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · SKILL.md (reported line 1546)May include surrounding context.
md
full template's four segments, all three boundaries written as `HARD CUT`, and all three there on a frame-by-frame read — in **all three** clips, though a scene detector at threshold 0.25 saw only two of the three in each of them. The reverse instruction was not contradicted in either accepted clip: `one single continuous camera move with no cut anywhere inside this segment` produced no detected cut inside the orbit, and the frames are consistent with that — but the same detector pass missed a real boundary in the same clip,