WaveSpeedAI Wan 2.2 Animate Character Animation & Swap

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:02 AM UTC
• Version: 2.0.1

Overview

The skill is clearly for WaveSpeed video animation, but it asks users to run unpinned npm tools that can use stored WaveSpeed credentials.

Review before installing. Use pinned package versions where possible, avoid running the MCP package with broad filesystem access, use scoped or revocable WaveSpeed credentials, check pricing before runs, and do not upload private or proprietary images or videos unless you are comfortable sending them to WaveSpeed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–20
Vulnerability Type: Unpinned third-party npm dependency
Risk Level: Medium

bash

npm install -g @wavespeed/cli
wavespeed login          # opens https://wavespeed.ai/accesskey and stores the key
wavespeed status         # confirms you are signed in

Technical Analysis

The setup instructions install the latest registry version of @wavespeed/cli globally without an exact version, lockfile, checksum, or package-provenance verification. Consequently, the code installed when a user follows these instructions may differ from the version reviewed during the skill audit.

A compromised package release, maintainer account, or npm registry resolution could introduce malicious installation lifecycle scripts or runtime code. Global installation also makes the package broadly available in the user's environment and can require elevated permissions on some systems.

No evidence establishes that the named package is currently malicious. The finding concerns the unsafe dependency acquisition method and its supply-chain exposure.

Attack Path

1. An attacker compromises the package publisher, publishing pipeline, or relevant registry resolution.
2. The attacker publishes a malicious version under the expected package name.
3. A user follows the skill instructions and runs npm install -g @wavespeed/cli.
4. npm resolves the unpinned dependency to the malicious release.
5. Malicious lifecycle or CLI runtime code executes with the invoking user's effective permissions.
6. The code may access files and environment variables available to that user, modify user-writable resources, or misuse locally stored credentials.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The accessible scope may include user-owned files, environment variables, authentication material readable by the process, and user-writable configurati ...[truncated 166 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed exact version, such as npm install @wavespeed/cli@X.Y.Z.
• Prefer a project-local or isolated installation instead of a global installation.
• Commit and enforce an npm lockfile where the surrounding execution model permits it.
• Verify npm package provenance and integrity before installation.
• Review package lifecycle scripts and use --ignore-scripts when they are unnecessary.
• Document a controlled upgrade and security-review process.
• Advise users not to run installation with administrator privileges unless strictly required.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Automatic Execution of an Unpinned MCP Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Unpinned third-party npm package executed through automatic installation
Risk Level: Medium

text

Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login. Every example below maps one-to-one onto `run_model` with the same model id and input fields.

Technical Analysis

The documented npx -y @wavespeed/mcp command resolves, installs, and executes the current registry version of @wavespeed/mcp. No exact version, lockfile, checksum, or provenance validation is specified. The -y option automatically accepts installation, reducing the opportunity for users to inspect the package and resolved version before execution.

The MCP process also shares the CLI's stored login according to the documentation. Therefore, malicious package code executing in that process may be able to access or misuse authentication state available under the user's account.

No evidence establishes that @wavespeed/mcp is currently malicious. The vulnerability is the unpinned, automatically accepted package execution pattern.

Attack Path

1. An attacker compromises the package maintainer, publication pipeline, or npm registry resolution.
2. A malicious release is published as the newest version of @wavespeed/mcp.
3. A user or agent invokes npx -y @wavespeed/mcp as documented.
4. npx automatically downloads and runs the malicious release without requiring interactive confirmation.
5. The package executes with the user's effective permissions.
6. The malicious process may read accessible local data, misuse available WaveSpeed authentication, alter user-writable files, or perform unauthorized network activity.

Impact Assessment

Successfu ...[truncated 405 chars]

Remediation

View remediation

Remediation Suggestions

• Pin a reviewed exact package version, for example npx --yes @wavespeed/mcp@X.Y.Z.
• Prefer a locally installed, lockfile-controlled dependency rather than runtime package resolution.
• Remove automatic acceptance where feasible so users can inspect the resolved package and version.
• Verify package provenance, integrity metadata, publisher identity, and repository-to-package correspondence.
• Run the MCP server in a sandbox or container with minimum filesystem and network permissions.
• Restrict credential access and use scoped, revocable credentials with spending and API limits.
• Establish a controlled process for reviewing and approving dependency upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends running npx -y @wavespeed/mcp without pinning a version, which causes the latest published package to be fetched and executed at runtime. If the package is compromised upstream or a breaking/malicious release is published, users may execute unreviewed code in their environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to upload local image/video files and submit media URLs to an external AI service, but it does not clearly warn that local media will leave the machine and be transmitted to a third party. This can lead to unintended disclosure of sensitive or proprietary visual data, especially because the examples normalize direct upload as the default workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.