WaveSpeedAI Seedance 1.5 Pro Video Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:02 AM UTC
• Version: 2.0.1

Overview

This skill is a straightforward WaveSpeed video-generation helper, with a notable but disclosed supply-chain and credential-handling risk from unpinned npm/MCP setup commands.

Install only if you are comfortable using WaveSpeed's CLI/MCP with your account, credits, prompts, and selected media files. Prefer pinning reviewed package versions, avoid running unpinned npx commands in sensitive environments, and use a restricted workspace with only the files needed for generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Third-Party Packages Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 16–23 **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: Medium **Code Snippet**: ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key wavespeed status # confirms you are signed in ``` ```markdown Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login. ``` ### Technical Analysis The skill instructs users or agents to install `@wavespeed/cli` globally and to download and execute `@wavespeed/mcp` through `npx -y`. Neither dependency is pinned to a reviewed version or verified with an integrity hash. Package installation can execute npm lifecycle scripts, while `npx -y` automatically resolves, downloads, and runs the package without an interactive confirmation. The code executed by these commands can therefore change after the skill has been audited. A compromised publisher account, malicious package release, or transitive dependency compromise could introduce attacker-controlled code. The global installation also creates a persistent command in the user's environment. Although no malicious persistence mechanism is present in the reviewed skill itself, the installation increases the consequences of a supply-chain compromise because the resulting executable may remain available after the skill run. ### Attack Path 1. An attacker compromises the publisher account, package release process, or dependency chain for `@wavespeed/cli` or `@wavespeed/mcp`. 2. The attacker publishes a malicious version under the same package name. 3. A user or agent follows the documented setup and runs the unversioned `npm ...[truncated 1207 chars]
• Remediation: ## Remediation Suggestions 1. Pin each package to an exact, reviewed version rather than resolving the latest available release: ```bash npm install --global @wavespeed/cli@<reviewed-version> npx --yes @wavespeed/mcp@<reviewed-version> ``` 2. Prefer a project-local installation governed by a committed lockfile over global installation. 3. Use npm integrity verification, trusted provenance, and package-signing controls where available. 4. Review package contents and lifecycle scripts before approving a version for use. 5. Avoid automatic `npx -y` execution. Install the reviewed dependency explicitly and invoke its local binary. 6. Run the tools in a restricted environment with only the files and environment variables required for the video-generation task. 7. Establish a controlled dependency-update process that repeats security review before changing pinned versions. 8. Document the expected publisher, repository, package version, and checksum so users can verify that they obtained the approved artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

```bash
npm install -g @wavespeed/cli

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill instructs use of `npx -y @wavespeed/mcp` without pinning a specific version, which allows whatever package version is current at execution time to run with the user's environment and stored WaveSpeed credentials. If the upstream package is compromised, publishes a breaking or malicious update, or is typosquatted in a supply-chain attack, the agent could execute unreviewed code and expose tokens or manipulate model requests.

Static analysis

No suspicious patterns detected.