Security audit

Seedance 2.5 60s

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill is not clearly malicious, but it needs review because it makes inconsistent capability claims and directs automatic file upload/generation without confirmation.

Install only if you are comfortable with automatic video generation, prompt translation, uploading attached reference media, retries, and temporary job tracking. Review the 60-second claims carefully because the actual instructions send 30-second durations and rely on fallback behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill contains materially contradictory execution instructions: it markets native 60-second generation and says it will attempt the true maximum first, yet its operative logic clamps requests to 30 seconds and sends 30 for 60-second requests. This is dangerous because downstream agents and users may rely on false capability claims, causing deceptive behavior, incorrect tool use, and unreliable automation paths.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description promises 'No external API,' but the skill later instructs uploading attachments and converting local files into URL-based inputs via FileBatchUpload. That mismatch can mislead users about where their files go and whether local media will be transmitted to another service, which is a privacy and consent risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes broad natural-language phrases for ordinary video requests, making accidental activation more likely. Overbroad activation is risky because it can route benign user conversation into an automated generation workflow without a clear boundary that the specialized skill has been intentionally invoked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs immediate generation and local attachment uploading without warning the user that their files may be processed and transmitted automatically. This is dangerous because attached media can contain sensitive personal or proprietary content, and the user is denied an opportunity to review or consent before processing begins.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly forbids confirmation before taking potentially impactful actions, including generating content and processing files. Removing confirmation safeguards increases the risk of unauthorized actions, privacy violations, and unexpected use of user resources or third-party services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file states that every prompt sent to the tool must be English and that the user's description should be translated automatically. This imposes a specific language choice on the processing path without offering the user an opt-in or explaining a documented necessity beyond implementation preference.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill adds persistent pipeline tracking, automatic retries, delayed dispatch behavior, and background job persistence that exceed a simple immediate-generation skill. Persistent state in /tmp and autonomous continuation increase the chance of unintended repeated processing, retention of user job metadata, and actions continuing after the original user interaction ends.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The skill authorizes autonomous decision-making by generating a keyframe with another tool, uploading it, and proceeding without asking the user when required input is missing. This is dangerous because it substitutes agent-invented content for user-provided references and expands the scope of action beyond the original request without consent.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
- Auto-inferred or user-specified ratio - `model_version: seedance_2.5` (forced) 3. If user asked for image-to-video but attached nothing: generate a keyframe with `image_gen`, upload it, then use it — do not ask the user. ---

Static analysis

No suspicious patterns detected.