seaart video public

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:31 AM UTC
• Version: 1.0.0

Overview

This appears to be a real SeaArt video tool, but it should go to Review because its instructions can expose the user's SeaArt session token.

Install only if you trust SeaArt with your prompts and image URLs, and do not let an agent print `SEAART_TOKEN`; use a non-disclosing presence check instead and consider narrowing activation to explicit SeaArt requests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:78

Finding

Authentication Token Exposed Through Shell Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:78
Vulnerability Type: Secret exposure through terminal and agent execution output
Risk Level: High

Vulnerable Code Snippet:

markdown

First, check if the `SEAART_TOKEN` environment variable is set. You can do this by running a simple bash command: `echo $SEAART_TOKEN`.

Technical Analysis

The skill explicitly instructs the agent to execute echo $SEAART_TOKEN. This command reveals the complete SeaArt session token in plaintext rather than merely checking whether the variable is configured.

Tool output may be retained in agent conversation records, execution transcripts, CI logs, terminal captures, monitoring systems, or debugging output. The instruction therefore contradicts the security guidance elsewhere in SKILL.md, which states that the token should not appear in chat messages or logs.

The Python implementation does not require the token to be printed. It retrieves the credential directly from the environment and uses it as the SeaArt T authentication cookie.

Attack Path

1. A user configures a valid SeaArt session token in SEAART_TOKEN.
2. The agent follows the instructions in SKILL.md.
3. The agent executes echo $SEAART_TOKEN.
4. The plaintext credential appears in terminal output or the agent's captured tool transcript.
5. An attacker or unauthorized operator with access to those records obtains the token.
6. The attacker supplies the stolen value as the SeaArt T cookie and makes authenticated requests as the victim until the token expires or is revoked.

Impact Assessment

Successful exploitation exposes the user's SeaArt session credential. An attacker may gain the privileges associated with that SeaArt session, including submitting authenticated generation tasks, consuming account credits or quotas, and accessing any account functionality authorized by the token.

The issue does not directly grant local oper ...[truncated 127 chars]

Remediation

View remediation

Remediation Suggestions

Replace the token-printing command with a non-disclosing presence check:

bash

if test -n "${SEAART_TOKEN:-}"; then
    echo "SEAART_TOKEN is configured"
else
    echo "SEAART_TOKEN is not configured"
fi

Additional hardening measures:

• Explicitly prohibit printing, logging, or returning the token in agent output.
• Redact SEAART_TOKEN in tool execution logs and error-reporting systems.
• Avoid commands such as env, printenv, shell tracing, or debugging output that could reveal the credential.
• Revoke and replace tokens that may already have appeared in retained logs.
• Prefer a dedicated, narrowly scoped API credential over a browser session cookie if SeaArt supports one.

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Locations: README.md:10, SKILL.md:15-16
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

Vulnerable Code Snippets:

README.md:10:

markdown

- `requests` library (`pip install requests`)

SKILL.md:15-16:

yaml

      - name: pip3
        description: Required to install the requests library if not present.

Technical Analysis

The setup documentation recommends installing requests without a pinned version, lock file, or integrity hash. The resolved package is therefore determined by the active package index and repository state at installation time rather than by an audited dependency specification.

If the Python environment is configured to use an untrusted or compromised package index, an attacker may supply a malicious package under the expected name. An unreviewed future release or compromised upstream release could also introduce malicious behavior. Python packages can execute code during installation through build backends and subsequently when imported by scripts/generate.py.

The use of the legitimate package name requests reduces ordinary typosquatting risk, but it does not eliminate dependency substitution, index misconfiguration, compromised release, or non-reproducible build risks.

Attack Path

1. A user follows the documented setup instructions and runs pip install requests.
2. The active pip configuration resolves packages through a malicious, compromised, or incorrectly prioritized package index, or resolves an unsafe future release.
3. Pip downloads the attacker-controlled distribution.
4. Malicious build or installation logic executes with the privileges of the user running pip, or malicious code is installed for later import.
5. When scripts/generate.py executes import requests, the hostile package can run in the process.
6. The malicious dependency can access process privi ...[truncated 645 chars]

Remediation

View remediation

Remediation Suggestions

Use a reviewed and reproducible dependency specification instead of an unconstrained installation command:

1. Pin requests and its transitive dependencies to reviewed versions.

2. Store dependencies in a lock file or hash-verified requirements file.

3. Require integrity verification, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Generate requirements.txt with exact versions and SHA-256 hashes from a trusted environment.

5. Explicitly use the official PyPI simple index where appropriate and review pip configuration for unexpected extra indexes.

6. Install dependencies inside a dedicated virtual environment with no elevated privileges.

7. Run automated dependency vulnerability and provenance checks when updating the lock file.

8. Update SKILL.md and README.md so they reference the locked installation procedure rather than pip install requests.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell commands, reads environment variables, and makes authenticated network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent may auto-activate the skill with broader capabilities than users expect, increasing the chance of unintended token access, command execution, or outbound data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation text uses broad phrases like 'create a video' and 'generate a video,' which are common user intents and may cause the skill to trigger in many unrelated situations. Because this skill reads a sensitive auth token and sends prompts or image URLs to an external service, over-broad activation raises the risk of accidental external data sharing or unintended use of the user's SeaArt account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.