Security audit

Byted Seedance Video Generate

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to generate videos as advertised, but it also tells the agent to store API keys in a workspace environment file, which needs review before use.

Review before installing. Use only a scoped video-provider API key, prefer the platform secret manager over workspace env files, and avoid sending private prompts or media URLs unless you accept that the configured remote provider will process them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documentation clearly indicates access to environment variables and external network resources, yet it declares no permissions. That mismatch reduces transparency and can cause the host agent to invoke a networked, credential-dependent capability without appropriate review or sandboxing. In context, a video-generation skill legitimately needs network and possibly env access, but omitting those permissions is still a security-relevant design flaw.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The instructions tell the agent to write API keys into a workspace environment file and make them effective automatically. Persisting secrets to local files expands credential exposure, increases the chance of accidental disclosure through logs, file access, or later tasks, and goes beyond the narrow need to perform one video-generation request. In this skill context, storing user credentials persistently is not necessary for basic operation, which makes the behavior especially risky.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims to generate videos but also instructs persistent modification of workspace configuration to store API credentials and retry automatically. This is functionality creep into secret handling and environment persistence, creating a durable attack surface unrelated to the core business purpose. Because the skill is media-generation focused, the hidden credential-management behavior is less expected and therefore more dangerous.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The skill accepts broad agent-level credentials (MODEL_AGENT_API_KEY) in addition to service-specific video credentials, violating least-privilege and increasing blast radius if the skill is misused or compromised. In this skill context, that is more dangerous because the code makes outbound network requests to a remote API, so a generic token could authorize actions beyond video generation.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger condition 'user asks for video generation capabilities' is broad enough that the skill may activate for generic exploratory or adjacent media requests. Overbroad invocation increases the chance that a network-enabled, credential-using skill runs in situations where it is not actually needed, which can expose prompts, references, or URLs to an external service unnecessarily. In combination with the credential-handling guidance elsewhere in the file, this broad matching increases overall risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The documentation instructs the agent to write credentials into an environment variable file and activate them without warning the user about storage, persistence, or scope. This can lead to silent retention of secrets in the workspace and use by future processes or tasks, violating user expectations and secure secret-handling practices. The lack of notice or consent makes the behavior particularly dangerous.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly directs the agent to capture user-provided API credentials, persist them in workspace files, and make them effective automatically. That is a classic secret-handling anti-pattern: it creates durable local secret copies, broadens access to the credentials beyond the immediate task, and may enable later exfiltration by other tools, logs, or users with workspace access. In a video-generation skill, there is no strong justification for automatic persistent secret storage, so the risk is elevated.

Static analysis

No suspicious patterns detected.