WaveSpeedAI Seedance 1.5 Pro Video Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:02 AM UTC
• Version: 2.0.1

Overview

This skill is a straightforward WaveSpeed video-generation helper, with a notable but disclosed supply-chain and credential-handling risk from unpinned npm/MCP setup commands.

Install only if you are comfortable using WaveSpeed's CLI/MCP with your account, credits, prompts, and selected media files. Prefer pinning reviewed package versions, avoid running unpinned npx commands in sensitive environments, and use a restricted workspace with only the files needed for generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–23
Vulnerability Type: Unpinned and automatically executed third-party dependencies
Risk Level: Medium

Code Snippet:

bash

npm install -g @wavespeed/cli
wavespeed login          # opens https://wavespeed.ai/accesskey and stores the key
wavespeed status         # confirms you are signed in

markdown

Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login.

Technical Analysis

The skill instructs users or agents to install @wavespeed/cli globally and to download and execute @wavespeed/mcp through npx -y. Neither dependency is pinned to a reviewed version or verified with an integrity hash.

Package installation can execute npm lifecycle scripts, while npx -y automatically resolves, downloads, and runs the package without an interactive confirmation. The code executed by these commands can therefore change after the skill has been audited. A compromised publisher account, malicious package release, or transitive dependency compromise could introduce attacker-controlled code.

The global installation also creates a persistent command in the user's environment. Although no malicious persistence mechanism is present in the reviewed skill itself, the installation increases the consequences of a supply-chain compromise because the resulting executable may remain available after the skill run.

Attack Path

1. An attacker compromises the publisher account, package release process, or dependency chain for @wavespeed/cli or @wavespeed/mcp.
2. The attacker publishes a malicious version under the same package name.
3. A user or agent follows the documented setup and runs the unversioned `npm ...[truncated 1207 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each package to an exact, reviewed version rather than resolving the latest available release:

   bash

   npm install --global @wavespeed/cli@<reviewed-version>
   npx --yes @wavespeed/mcp@<reviewed-version>
   

2. Prefer a project-local installation governed by a committed lockfile over global installation.
3. Use npm integrity verification, trusted provenance, and package-signing controls where available.
4. Review package contents and lifecycle scripts before approving a version for use.
5. Avoid automatic npx -y execution. Install the reviewed dependency explicitly and invoke its local binary.
6. Run the tools in a restricted environment with only the files and environment variables required for the video-generation task.
7. Establish a controlled dependency-update process that repeats security review before changing pinned versions.
8. Document the expected publisher, repository, package version, and checksum so users can verify that they obtained the approved artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs use of npx -y @wavespeed/mcp without pinning a specific version, which allows whatever package version is current at execution time to run with the user's environment and stored WaveSpeed credentials. If the upstream package is compromised, publishes a breaking or malicious update, or is typosquatted in a supply-chain attack, the agent could execute unreviewed code and expose tokens or manipulate model requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.