Byted Seedance Video Generate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This video-generation skill mostly does what it says, but it needs review because it tells agents to store API keys in the workspace and can send those keys to a configurable API endpoint.

Install only in a trusted workspace. Preconfigure the API key through a secure secret mechanism rather than letting the agent write it into workspace files, and verify ARK_BASE_URL or MODEL_VIDEO_API_BASE points only to the intended provider before use. Do not submit confidential prompts, signed media URLs, or private reference assets unless you trust the configured video service and account controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/video_generate.py:11

Finding

Bearer API credentials can be transmitted to an attacker-controlled API endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/video_generate.py, lines 11-21; credential use occurs in _get_headers, _create_video_task, and _get_task_status
Vulnerability Type: Unrestricted externally configurable service endpoint with automatic credential forwarding
Risk Level: High

Relevant Code:

python

API_KEY = (
    os.getenv("ARK_API_KEY")
    or os.getenv("MODEL_VIDEO_API_KEY")
    or os.getenv("MODEL_AGENT_API_KEY")
)
API_BASE = (
    os.getenv("ARK_BASE_URL")
    or os.getenv("MODEL_VIDEO_API_BASE")
    or "https://ark.cn-beijing.volces.com/api/v3"
).rstrip("/")
API_BASE = API_BASE.replace("/api/coding/v3", "/api/v3")

The configured credential is unconditionally placed in an authorization header:

python

def _get_headers() -> dict:
    return {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {API_KEY}",
    }

The header is then sent to the configurable endpoint:

python

async def _create_video_task(
    prompt: str, config: VideoGenerationConfig, model_name: str
) -> dict:
    url = f"{API_BASE}/contents/generations/tasks"
    body = _build_request_body(prompt, config, model_name)

    async with httpx.AsyncClient(timeout=60.0) as client:
        response = await client.post(url, headers=_get_headers(), json=body)
        response.raise_for_status()
        return response.json()

python

async def _get_task_status(task_id: str) -> dict:
    url = f"{API_BASE}/contents/generations/tasks/{task_id}"

    async with httpx.AsyncClient(timeout=60.0) as client:
        response = await client.get(url, headers=_get_headers())
        response.raise_for_status()
        return response.json()

Technical Analysis

ARK_BASE_URL and MODEL_VIDEO_API_BASE are accepted without validating their scheme, hostname, port, or relationship to the expected Volcengine service. Regardless o ...[truncated 2228 chars]

Remediation

View remediation

Remediation Suggestions

1. Allowlist the exact production API host or a narrowly defined set of approved hosts. Reject all other destinations before constructing headers.
2. Require HTTPS and reject URLs containing user information, fragments, unexpected ports, IP literals, or ambiguous hostnames.
3. Keep credential selection bound to the selected provider. Never forward an ARK credential to an arbitrary custom endpoint.
4. If custom endpoints are operationally required, require a separate endpoint-specific credential and explicit administrator approval.
5. Validate the final URL immediately before every request, including after normalization and redirects.
6. Disable automatic HTTP redirects, or validate every redirect destination before forwarding the authorization header.
7. Use a preconfigured httpx.AsyncClient with a fixed trusted base URL rather than concatenating an unrestricted environment value.
8. Redact authorization headers, prompts, and signed media URLs from logs and exception telemetry.
9. Rotate any API key that may already have been used while the endpoint variables were controlled by an untrusted party.
10. Add tests confirming that unapproved domains, non-HTTPS schemes, unexpected ports, and cross-origin redirects are rejected.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:185

Finding

Skill instructions direct the agent to persist API credentials in a workspace environment file without storage safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 185-190
Vulnerability Type: Insecure plaintext credential persistence
Risk Level: Medium

Relevant Instruction:

markdown

## Error Handling

- IF the script raises the error "PermissionError: ARK_API_KEY or MODEL_VIDEO_API_KEY or MODEL_AGENT_API_KEY not found in environment variables", inform the user that they need to provide the `ARK_API_KEY` or `MODEL_VIDEO_API_KEY` or `MODEL_AGENT_API_KEY` environment variable. Write it to the environment variable file in the workspace. If the file already exists, append it to the end. Ensure the environment variable format is correct, make the environment variable effective, and retry the video generation task that just failed.

Technical Analysis

The skill explicitly instructs the agent to write a supplied API key into an unspecified environment-variable file inside the workspace and to append to an existing file. It does not require restrictive permissions, encryption, exclusion from version control, use of an approved secret manager, verification of the target file, or protection against symbolic links.

A workspace commonly has broader exposure than a dedicated credential store. Its contents may be available to other tools, agents, processes, backups, artifact collectors, logs, or source-control operations. Appending also risks retaining obsolete credentials and writing secrets into an attacker-prepared file.

Because the target filename and ownership requirements are unspecified, the instruction can cause unpredictable credential placement. The instruction to “make the environment variable effective” may also increase the number of processes or subprocesses that inherit the secret.

Attack Path

1. The skill runs without one of the supported API-key environment variables.
2. Following SKILL.md, the agent asks the user to provide an API key.
3. The agent writes or appends the key to an environment ...[truncated 957 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to write API keys into an unspecified workspace file.
2. Prefer an approved operating-system credential store, deployment secret manager, or platform-managed secret-injection mechanism.
3. If file-backed storage is unavoidable, use a fixed path outside the shared workspace with owner-only permissions such as mode 0600.
4. Create the file atomically and reject symbolic links, unexpected ownership, and pre-existing non-regular files.
5. Add the secret file to source-control and artifact-export exclusion rules.
6. Never print the supplied key or include it in command-line arguments, generated reports, exception messages, or logs.
7. Do not append indefinitely. Replace the designated value safely and remove obsolete credentials.
8. Obtain explicit user confirmation before persisting a credential and clearly disclose its storage path and retention policy.
9. Load the credential only into the process that requires it and avoid unnecessary inheritance by unrelated subprocesses.
10. Provide revocation and rotation guidance when workspace credential exposure is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly directs writing API keys into an environment file and retrying automatically, without any warning about sensitive credential handling or limitations on where the secret is stored. This normalizes unsafe secret persistence and can lead to credential leakage through filesystem access, backups, debugging artifacts, or subsequent agent actions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the agent to persist and activate user-provided API credentials in the workspace environment and then automatically retry. This is dangerous because it turns the skill into a credential-handling workflow, enabling secret retention and reuse outside the immediate task and increasing the blast radius if the workspace or agent context is later compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permissions despite clearly relying on environment access and network operations. This creates an authorization ambiguity where an agent may invoke capabilities beyond what the manifest transparently communicates, increasing the chance of unintended or over-privileged execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger condition 'User asks for video generation capabilities' is broad enough to activate the skill in exploratory or tangential conversations, not just concrete requests to generate media. Over-broad invocation increases the chance of unnecessary access to networked functionality and sensitive operational instructions, especially when the skill also contains unsafe credential-handling guidance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation instructs the agent or user to modify workspace environment-variable files and make credentials effective, which goes beyond ordinary video generation and introduces secret-handling behavior. Persisting credentials in workspace files expands exposure to other tools, logs, sessions, or later tasks that may read those files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code posts the user-provided prompt plus any first/last frame, reference image, video, and audio URLs to an external service via HTTP. Although this is part of the tool's function, the code path itself lacks a direct disclosure such as a confirmation prompt or explicit notice that user content and referenced media locations will be transmitted off-system.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/video_generate.py (reported line 162)May include surrounding context.

python

"watermark",
    ]
    for field_name in optional_fields:
        value = getattr(config, field_name, None)
        if value is not None:
            body[field_name] = value

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The query path transmits task IDs to the external API to retrieve generation status, but the code does not explicitly tell the user that status checks contact a remote service. This is a minor missing-warning issue because it involves outbound network activity tied to user workflow state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.