Security audit

seedream5

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its credential script can turn a saved API key file into executable shell code, so users should review it before installing.

Install only if you are comfortable reviewing or changing the helper scripts first. Prefer providing X_API_KEY only for the current session, avoid saving keys with set_key.sh, and do not run generate.sh against a .env file whose contents you did not create and verify.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/set_key.sh:9
Finding: Stored Shell Command Injection Through Sourced Credential File
Content: View full analysis
"$CONF_FILE" <
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate.sh:66
Finding: Request Manipulation Through Unsafe Manual JSON Construction
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to read credentials from conversation input, environment variables, and a local .env file. Accessing and reusing secrets from multiple sources increases the likelihood of unintended credential handling, accidental disclosure, or use of stale/incorrect keys, especially in automated agent contexts.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
1. 本次对话显式输入的 x-api-key 2. 环境变量 X_API_KEY 3. 本地持久化文件 ~/.config/seedream5.0/.env 首次配置（只需一次）：

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The documentation provides concrete instructions for writing the API key into a plaintext .env file under the user's home directory. Even with restrictive permissions, plaintext file storage raises exposure risk through endpoint compromise, shell history mistakes, backups, sync tools, and other local processes running as the same user.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
bash
mkdir -p ~/.config/seedream5.0 cat > ~/.config/seedream5.0/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/seedream5.0/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: This line is part of the credential persistence workflow around ~/.config/seedream5.0/.env and reinforces use of a local secret file. The surrounding context makes the skill more dangerous because it normalizes durable credential storage for routine use without strong guardrails or lifecycle controls.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
cat > ~/.config/seedream5.0/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/seedream5.0/.env

text
## 核心接口

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The quick-start command advertises a helper script that saves the API key to ~/.config/seedream5.0/.env, making persistent secret storage easy and likely. This convenience increases the probability of widespread insecure key handling across deployments, especially by less experienced users who may not understand the persistence implications.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
## 快速执行脚本 - ./scripts/set_key.sh "你的x-api-key"：保存 key 到 ~/.config/seedream5.0/.env - ./scripts/generate.sh --prompt "提示词" [--size "2048x2048"] [--watermark true] [--image "https://example.com/a.png"] ## 目录结构（标准）

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The script uses shell source (. "$HOME/.config/seedream5.0/.env") to load the API key file, which executes arbitrary shell commands contained in that file. If an attacker can modify the .env file or place a malicious one there, running the skill will execute attacker-controlled code with the user's privileges.
Content: Scanner excerpt · scripts/generate.sh (reported line 46)May include surrounding context.
sh
if [[ -z "${X_API_KEY:-}" && -f "$HOME/.config/seedream5.0/.env" ]]; then set -a . "$HOME/.config/seedream5.0/.env" set +a fi

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/generate.sh (reported line 73)May include surrounding context.
sh
payload=$(printf '{"prompt":"%s","size":"%s","watermark":%s,"image":%s}' "$prompt" "$size" "$watermark" "$images_json") response=$(curl -s -m "$TIMEOUT" --location "$API_URL" \ --header 'Content-Type: application/json' \ --header "x-api-key: $X_API_KEY" \ --data "$payload" 2>&1)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate.sh (reported line 44)May include surrounding context.
sh
KEY="$1" CONF_DIR="$HOME/.config/seedream5.0" CONF_FILE="$CONF_DIR/.env" mkdir -p "$CONF_DIR" cat > "$CONF_FILE" <<EOF

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/set_key.sh (reported line 11)May include surrounding context.
sh
KEY="$1" CONF_DIR="$HOME/.config/seedream5.0" CONF_FILE="$CONF_DIR/.env" mkdir -p "$CONF_DIR" cat > "$CONF_FILE" <<EOF

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill documents shell-based setup and execution scripts but does not declare any explicit tool scope or allowed-tools boundary. In agent environments, this increases the chance the skill can trigger shell-capable behavior without clear containment, which broadens the attack surface and makes review and enforcement harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation guidance uses broad, common phrases like '生成图片' and '帮我生成一张图片', which can cause the skill to trigger in situations where the user did not intend to invoke this external API workflow. Unintended activation can lead to unnecessary external data transmission, accidental API use, and exposure of persisted credentials or billing-backed operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill encourages long-term storage and reuse of the x-api-key in environment variables and a local ~/.config/seedream5.0/.env file, but it does not clearly warn users about persistence risks, shared-machine exposure, backup leakage, or revocation procedures. Because this is an authentication secret, silent persistence materially increases the blast radius if the host, account, logs, or dotfiles are later exposed.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill establishes session persistence by creating a configuration directory and saving reusable authentication state across sessions. Persistent auth state is not inherently malicious, but in this context it increases risk by enabling future API calls without fresh user intent and by extending the lifetime of a sensitive credential on disk.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
首次配置（只需一次）：

bash
mkdir -p ~/.config/seedream5.0 cat > ~/.config/seedream5.0/.env << 'EOF' X_API_KEY=你的x-api-key EOF

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
cat > ~/.config/seedream5.0/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/seedream5.0/.env

text
## 核心接口

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The skill sends user-supplied prompt data, optional image URLs, and an API credential to an external third-party endpoint. External transmission is expected for this skill's purpose, but it still creates privacy and data-handling risk if users are not clearly informed that their content and references leave the local environment.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
详细接口说明见 references/api-guide.md。

bash
curl --location 'https://agent.mathmind.cn/minimalist/api/volcengine/ai/fzGenerateImg5' \ --header 'Content-Type: application/json' \ --header 'x-api-key: <YOUR_X_API_KEY>' \ --data '{"prompt":"一只猫咪在玩耍","size":"2048x2048","watermark":true,"image":[]}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-guide.md (reported line 20)May include surrounding context.

watermark: boolean, optional, default true

image: string[], optional, default []

cURL Example

bash
curl --location 'https://agent.mathmind.cn/minimalist/api/volcengine/ai/fzGenerateImg5' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/generate.sh (reported line 73)May include surrounding context.
sh
payload=$(printf '{"prompt":"%s","size":"%s","watermark":%s,"image":%s}' "$prompt" "$size" "$watermark" "$images_json") response=$(curl -s -m "$TIMEOUT" --location "$API_URL" \ --header 'Content-Type: application/json' \ --header "x-api-key: $X_API_KEY" \ --data "$payload" 2>&1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code sends the assembled JSON payload, including the user prompt and any provided image inputs, to a remote HTTP endpoint via curl. While the operation is central to image generation, the script itself provides no confirmation, logging, or comment warning that user-supplied content is transmitted off-box to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script stores a provided API key in a plaintext file under the user's home directory without warning the user about persistent credential storage. Even with restrictive file permissions, writing secrets to disk increases exposure through backups, endpoint compromise, accidental inclusion in support bundles, or later misuse by other local processes running as the same user.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/set_key.sh (reported line 17)May include surrounding context.
sh
cat > "$CONF_FILE" <<EOF X_API_KEY=$KEY EOF chmod 600 "$CONF_FILE" echo "x-api-key saved to $CONF_FILE"

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

External Script Fetching

Credential Access

Credential Access

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Session Persistence

Sudo/Root Execution

External Transmission

External Transmission

cURL Example

External Transmission

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Static analysis