T09 · Insecure Skill Coding Practices
Error
- Location
scripts/client.js:1- Finding
Bearer Token and User Content Can Be Sent to Arbitrary Configured Endpoints
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance Video
Security checks for vulnerabilities and agentic risk
Overview
This Seedance video skill is mostly coherent, but needs review because it can send its bearer token and request content to any endpoint configured in the environment.
Review the source of AIZNT_PROXY_URLS before installing or running this skill. Only use it where the configured Seedance proxy URLs are trusted HTTPS endpoints, because a bad endpoint configuration could receive the TS_TOKEN credential and submitted prompt or media request data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented purpose is a specific Seedance video-generation skill, but the described implementation behavior is largely generic credential loading and HTTP helper logic rather than tightly constrained Seedance-specific processing. This mismatch is dangerous because misleading documentation can cause operators to trust and invoke a skill with broader or different behavior than expected, which can hide risky network actions or secret handling from normal review.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares access to environment variables and network-backed endpoints via metadata, but does not declare any explicit tool scope such as permissions or allowed-tools. In agent environments, this weakens least-privilege controls and can allow the skill to use sensitive capabilities without clear policy review, increasing the chance of secret exposure or unintended outbound requests.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The tagline is in Chinese while the description is in English, but the manifest does not explain whether the skill requires or defaults to a specific language. This can create a locale/language expectation mismatch without explicit user opt-in or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This code accesses sensitive environment variables (
TS_TOKENandAIZNT_PROXY_URLS) and returns them for later use, but it provides no user-facing warning, confirmation, or logging that credentials and proxy endpoint data are being consumed. The existing comment and thrown errors are developer-oriented validation messages, not disclosures to the user about sensitive data handling.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This script presents user-facing validation and help text in Chinese only, including the JSON parsing error and usage instructions. That imposes a specific language on all users without any visible opt-in or alternative locale support, which matches the language/locale policy violation category.
- Content