Security audit

视频提示词生成器（Seedance2.0）

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches video prompt and MP4 generation, but it hides a usage-reporting call that can send the Redfox API key and uses broad persistent credential handling.

Review before installing. Use a limited, revocable Redfox API key, prefer passing it only for the current session, and avoid allowing the skill to edit shell profiles or permanent user environment variables. Expect prompts to be sent to Redfox for generation, and be aware that the artifacts include silent usage reporting that can transmit the API key.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill documentation describes behavior that relies on environment access, file reads, and network activity, but it declares no corresponding permissions. This creates a transparency and least-privilege problem: users and hosts cannot accurately assess what the skill may access or transmit, especially when credentials and remote video generation are involved.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill presents itself primarily as a prompt-writing assistant, but its documented behavior extends to remote task creation, polling, downloading files, reading credentials from multiple local sources, and reporting usage to a third party. That mismatch reduces informed consent and materially changes the trust boundary by moving user prompts, metadata, and credentials into broader local and remote handling than the description suggests.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to persistently modify shell profiles or Windows user environment settings to install API credentials. Persistent credential setup is broader than necessary for a prompt-writing skill and can create long-lived secrets exposure, accidental reuse by unrelated tools, and unwanted system configuration changes initiated by the agent.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill metadata promises direct MP4 generation, but the documented command at this location only performs a hidden usage-recording action and explicitly does not generate video. This discrepancy is dangerous because it can mislead users and reviewers about what the skill actually does, obscuring hidden side effects and preventing informed consent.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The workflow instructs a silent telemetry/reporting call after producing output, and says failures should be hidden from the user. Undisclosed background reporting unrelated to the visible prompt-writing function violates transparency and can exfiltrate usage data without user knowledge or consent.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs reading environment variables, shell startup files, and persistent user environment state to locate credentials before performing its main task. For a prompt-writing skill, this is over-privileged behavior that expands access to sensitive secrets and local configuration well beyond necessity, creating credential exposure and privacy risks.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script searches multiple local credential sources, including shell RC files and Windows persistent environment storage, to obtain an API key automatically. For a skill presented as a video-prompt expert, this broad credential discovery increases unnecessary access to local secrets and expands the trust boundary beyond what a user explicitly supplied at runtime.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code contains a separate telemetry-style call to RECORD_URL that sends the user's API key and source string independently of core video generation. This is unrelated to prompt authoring and creates an extra data flow of sensitive credentials to a remote endpoint without clear necessity or prominent consent.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The advertised skill claims to help write professional video prompts, but the implementation actually performs remote task submission, polling, and media downloading. This capability mismatch is security-relevant because users may grant trust expecting local prompt assistance while the code instead sends content and credentials to external services and writes files to disk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly says the skill can 'directly generate video' and 'automatically download' output, but it does not clearly warn users at the point of use that invoking this feature will trigger an external API call and a file download. This creates a meaningful transparency and consent problem: users may unintentionally send prompts or related data to a third-party service and cause local side effects without an explicit confirmation step.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The trigger list contains broad phrases that may match ordinary user requests, causing the skill to activate unexpectedly. Unintended activation is especially relevant here because the skill can lead to network use, credential handling, and file operations beyond simple text assistance.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation encourages persistent API key configuration and even agent-assisted setup without adequately warning about credential exposure, shell/profile modification, or the security implications of making secrets globally available. This can lead users to store sensitive keys in places readable by other local processes or to make changes they do not fully understand.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow explicitly requires a silent usage-recording command and instructs that it should not be disclosed to the user. Hidden side-effectful execution is dangerous because it bypasses user awareness and consent, and in an agent setting it can normalize covert command execution unrelated to the requested task.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The telemetry function transmits an API key that may have been harvested from environment variables, shell configuration files, or local config to a separate remote endpoint, and it does so silently. Sending credentials to an endpoint other than the primary service operation materially increases the risk of secret exposure, misuse, logging, or backend compromise.

Static analysis

No suspicious patterns detected.