ClawHub
Back to skill

Security audit

video-animate

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious because its installation guidance uses unpinned package commands and its video workflow lacks clear warnings about sending user assets to external services; no clear malicious intent is established.

Consider whether you are comfortable with unpinned package commands and with the possibility that project media or prompts may be sent to external providers. The verdict is suspicious, not malicious, but evidence is incomplete: Skillspector marked its analysis partial because several local references were unresolved, and the other scanner returned no findings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Findings (18)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md
| Check | How | Pass |
|---|---|---|
| Cuts against the plan | `take_check.py --plan` (keyframes on cuts, then scene detection) | Within 1 frame with `@video1`. Text timestamps alone: expect about a second |
| Pass-through or grey copy | `take_check.py --reference` | No warning, and frames do not look like the previz |
| Previz look | Compare action takes with the previz | Does not still move like a clean animatic, one of two styles Joseph Kahn says AI flip-flops between (https://x.com/JosephKahn/status/2070788059680194970) |
| Stray text, logos, bars | Read frames at full size | None |
| People, hands, identity | QA list in `varg-video-prompting`, checked on full-size frames | Exactly as the shot names them |

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/drafts-and-takes.md (reported line 25)May include surrounding context.

md
| Question | Answer |
|---|---|
| Judge at 480p | Staging, camera, cut timing, shot order [inference, from BytePlus's list] |
| Do not judge at 480p | Faces, hands, small text, logos. Fine print "is a smear in the draft" (AiuniVid); a small preview may hide "hand, face, text, or audio defects" (https://anikuku.com/blog/seedance-2-5-draft-mode-cost-guide [vendor]); a logo changed in an otherwise 90 to 95% match (https://x.com/AI__TSUBAKI/status/2116843344399937692 [self]) |
| Warning on the numbers | Segmind's metric is 64x64 greyscale, so it shows blocking matched, not that a face stayed the same person [inference]. AiuniVid's is SSIM on luma; the two do not contradict. Vendor claims of an exact match (Picsart [vendor]) go further than either test |
| Not tested by anyone found | Identity between draft and final. Draft to final on video-to-video from a previz (Segmind's five clips were text prompts). No Draft-style binding was found for Kling 4, Veo 3.1 or Wan 3 |

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/take_check.py (reported line 230)May include surrounding context.

python
for warning in warnings:
            print(f"WARNING {warning}")
        if not warnings:
            print("no warnings")

    return 1 if warnings else 0

The animation workflow lacks a warning that input assets will be sent to third-party generation services.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The workflow directs the agent to animate existing previz and generate takes using Seedance or other hosted models. Although the README lists the API and providers, it does not warn that supplied renders, reference images, or prompts used for generation leave the user's environment, which matters for confidential or unreleased material.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation command executes an unpinned npm package through npx, so its executed code can change without this README changing. A compromised package release could execute code with the installing user's privileges; this is a supply-chain exposure, although the finding incorrectly describes the command as an MCP server reference.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/drafts-and-takes.md (reported line 186)May include surrounding context.

md
ake, break-even at 1.22, then 32%, 49% and 62% less at 2, 3 and 5 takes ("Not cheaper video: cheaper mistakes." [vendor]). Its table reads direct 1080p at 70.38 credits/s, or 13,935 against the 13,543 above |
| Blocking pass | Adds 936 credits: 7% on 1080p, 17% on 720p. One run lost at 1080p with 3 takes costs 2,257, more than the whole pass |
| Route | PiAPI routes cost about double every Seedance row (124, 289, 660 per 5 s against 64, 139, 342), and no route may carry a real person's likeness without consent. Confirm the BytePlus route is live before planning on it |
| Billing | BytePlus has minimums for video input (anikuku [vendor]) and clay seconds bill on Seedance. Older varg files say 16 credits/s, which predates pass-through pricing [inference]. varg's own reference treats `estimate_cost` as a ceiling: it quoted 361 credits for a 9 s job billed 145. Quote and approve each batch before running it (https://x.com/EianLu/status/2117469941364637983 [self]) |
| Contingency, not count

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/links.md (reported line 95)May include surrounding context.

md
| Name | Holds, size | Access | Rights: model, bots |
|---|---|---|---|
| [ElevenLabs Sound Effects](https://elevenlabs.io/docs/capabilities/sound-effects) | Generates from text, up to 30 s. Mirelo SFX (moodboard directory, section 3) generates from video | API; hosted MCP `https://api.elevenlabs.io/v1/mcp` (OAuth); also through the varg API | Free tier non-commercial, paid commercial, no competing products |
| [Epidemic Sound](https://www.epidemicsound.com/) ([MCP](https://www.epidemicsound.com/tools/mcp/)) | 55,000+ tracks, 250,000+ SFX and variations [vendor]. Search by mood, BPM, genre, reference track | MCP beta: search free, downloads need a subscription | "not a new license"; no AI training clause found |
| [Sonniss GDC bundles](https://sonniss.com/gameaudiogdc) | 207.0 GB in 73 zips, 2015-2024; a 2026 bundle has its own page | Free download | Final mix only. See Rights |
| [Freesound](https://freesound.org/), [Pixabay](https://pixabay.com/sound-effects/) | Creative Commons per

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/models.md (reported line 82)May include surrounding context.

md
| PiAPI | 9 | 3, 15.4 s total | 3, 15 s total | | [Live spec](https://varg.ai/models/seedance_2_5.md) summary line for counts, api seed [vendor] for totals |
| BytePlus | 30 | 10, each 2-30 s, 30 s total | 10, 30 s total | 50 assets | [BytePlus tutorial](https://docs.byteplus.com/en/docs/ModelArk/2607688), [ComfyUI](https://docs.comfy.org/tutorials/partner-nodes/bytedance/seedance-2-5/workflow.md) |

- Design each shot for 9/3/3, then read the [live schema](https://api.varg.ai/v2/tools/video?model=seedance_2_5%29%3A `files` allows 50 for the whole model, not per route.
  Our sources give no fal limit. Dreamina, not a varg route, takes 12 files ([Chris via PJ Ace](https://x.com/PJaccetturo/status/2116160709180723486) [vendor]).
- Fewer behaves better: [mix-ups](https://x.com/kan_mi_no9/status/2071964948314607704) [self]; "So maybe sometimes consider deleting a reference." ([Dreamina](https://x.com/dreamina_ai/status/2100927228356026407) [vendor]).
- Clay files on BytePlus: mp4 or mov, 24-60

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/prompts.md (reported line 189)May include surrounding context.

md
The cost: without clay, Seedance 2.5 kept crossing the axis in one dialogue test (ToAPIs [self] https://x.com/MaddieSmitxfs1/status/2117531141095948371).

## Request fields per template
Checked 2026-11-03 against `https://varg.ai/models/{model}.md` and `https://api.varg.ai/v2/tools/video?model=%7Bmodel%7D%60.
BP = `byteplus:dreamina-seedance-2-5-260628`. REF = `provider_options.byteplus.omni_reference_task_type: "reference"`.
MOV = `provider_options.byteplus.output_format: "mov"`. `fal.x` = `provider_options.fal.x`. Durations are ours
[inference]; 4-11 s is varg's range for locked timing, no published threshold. Also set `aspect_ratio`.

The multi-model comparison workflow lacks a warning that reference assets will be shared with multiple third-party providers.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The comparison workflow recommends sending the same reference material through several providers without a separate asset-sharing authorization gate. Although external model use is integral to this skill, expanding distribution across providers can expose confidential previz, unreleased designs, or personal media beyond the user's approved processing scope.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The command invokes an unversioned npm CLI, not an MCP server, but the dependency-pinning concern is valid. If the package is absent locally, npx can retrieve and execute a changing registry version with the agent's privileges, exposing project files and available credentials if an upstream release is compromised.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/prompts.md (reported line 96)May include surrounding context.

points [measured]. Long moves need an end frame, or mannequins reappear (Sharipov [self] https://x.com/aigenboss/status/2115587840704708984).

5. Audio-driven: tempo or performance, sound on then discarded, No BGM

From: "@Audio1 provides tempo only" (Emily2040 [self] https://github.com/Emily2040/seedance-2.0/blob/main/skills/seedance-audio/SKILL.md); "No BGM; generate only environmental sounds and action sounds." (Fuser [vendor] https://fuser.studio/articles/seedance-2-5-prompt-guide). For: a body in time with music, or on-camera speech. Tested as written: no; the speech line is ours [inference].

text

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/sound-sync.md (reported line 45)May include surrounding context.

md
ct file, "not 100% identical" | [SeeGen](https://seegen.ai/seedance-2-0-audio-guide) [vendor], no metrics; [MrDavids1](https://x.com/MrDavids1/status/2115485216361869757) [self], also on MiniMax H3 |
| Role binding | Give the audio one job: "@Audio1 provides tempo only", or "@Audio1 controls tempo and energy" with a video reference for camera. Hold native sound down: "No BGM; generate only environmental sounds and action sounds." | [Emily2040](https://github.com/Emily2040/seedance-2.0/blob/main/skills/seedance-audio/SKILL.md) [self], unmeasured; [Fuser](https://fuser.studio/articles/seedance-2-5-prompt-guide) [vendor] |
| Timestamps | Whole seconds, `[0-3s]`: "supports integer-second timestamps", "not frame-accurate edit points". One test put a line at 4.3 to 4.9 s inside a requested 2 to 5 s. H3 Max "can run up to about 0.7 s longer than requested". Finer forms exist, such as speech windows to 0.01 s, but nobody has measured whether a model obeys them | [BytePlus](https://docs.byteplu

The workflow instructs uploading local reference media without warning that user assets will be sent to external services.

Medium
Category
Output Handling
Confidence
95% confidence
Finding

The workflow explicitly directs uploading local reference files once the budget is approved, but financial approval does not establish permission to disclose those files externally. Characters, location references, and audio may contain confidential or personal information, and the fallback routing can introduce additional recipients.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/routing.md (reported line 21)May include surrounding context.

md
rame; anything re-rendered alone | "For animation requiring this kind of precision, traditional CG methods are easier." ([Matsunaga](https://note.com/overhead_vfx/n/n501cf67cd115) [self], translated, part paywalled). "never ask the model to type your slogan" ([KRUX](https://x.com/kruxael/status/2117381314370224424) [self], promotes follow-gated giveaways). Each frame is a function of its number ([Higgsfield SKILL.md](https://raw.githubusercontent.com/higgsfield-ai/higgsfield-video-engineer/main/skills/code-based-films/SKILL.md)) | Higgsfield's project is [code only](https://github.com/higgsfield-ai/higgsfield-video-engineer) with no rule for choosing. Cite it for the code route, not for routing |
| AI video | Faces, skin, light, smoke, crowds, at the cost of re-rolls | Seedance 2.5 leads Artificial Analysis on human anatomy and photoreal prompts ([AA thread](https://x.com/ArtificialAnlys/status/2115483562921304316)). "let blender own the motion and seedance own the look" (KRUX) | AA ra

The reference-input workflow lacks a warning that user media will be sent to third-party AI services.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The workflow directs the agent to supply user images and video as model references without requiring disclosure of the external recipient or approval before upload. Consent to use someone's likeness does not necessarily authorize third-party processing, so following this workflow could expose private footage or confidential production assets; the source does not establish that any disclosure has occurred.

Content

No source excerpt is available for this finding.

The audio-reference workflow lacks a privacy warning about sending recordings to external model providers.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The workflow recommends supplying recorded speech or a soundtrack to external generation and synchronization services without an explicit privacy disclosure or upload-authorization checkpoint. Its rights-to-use requirement addresses licensing but not permission for third-party processing, leaving private speech or unreleased recordings at risk of unintended disclosure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/take_check.py (reported line 28)May include surrounding context.

python
def run(cmd):
    return subprocess.run(cmd, capture_output=True, text=True, errors="replace")


def probe(path):