WaveSpeedAI Wan 2.6 Video Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:07 AM UTC
• Version: 2.0.1

Overview

This skill is a coherent WaveSpeed video-generation helper, with normal third-party CLI and media-upload cautions but no hidden or malicious behavior in the artifact.

Install only if you are comfortable using WaveSpeed's CLI/MCP and sending selected prompts or media to WaveSpeed. Prefer reviewed or pinned package versions where possible, avoid sensitive local files unless intentional, and check price before running paid generations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party CLI and MCP Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-19 and 26
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: Medium

The skill instructs users to install or directly execute third-party npm packages without specifying reviewed versions or verifying package integrity.

bash

npm install -g @wavespeed/cli
wavespeed login

bash

npx -y @wavespeed/mcp

Technical Analysis

The commands resolve the packages using mutable npm registry metadata. The global installation of @wavespeed/cli does not specify a version, while npx -y @wavespeed/mcp automatically downloads and executes the resolved package without an interactive confirmation.

Consequently, the code executed by users can differ from the code that was available when the skill was reviewed. If the package publisher account, npm package, release process, or another component of the distribution channel is compromised, a malicious release could execute through npm lifecycle hooks or during normal CLI operation.

The exposure is particularly relevant because the documented CLI stores and uses a WaveSpeed API credential, communicates with an external service, and can upload user-selected local files. There is no evidence in the audited project that either named package is currently malicious; the finding concerns the unsafe, unpinned dependency execution mechanism.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious package version under the expected package name.
3. A user follows the skill instructions and runs the unversioned npm install -g or automatic npx -y command.
4. npm resolves the attacker-controlled release because no reviewed version or integrity constraint is specified.
5. Malicious code executes with the permissions of the user running npm, either through installation hooks or pa ...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each package to an explicitly reviewed version, for example @wavespeed/cli@<reviewed-version> and @wavespeed/mcp@<reviewed-version>.
• Avoid automatic execution with npx -y; install a reviewed version through a controlled dependency workflow before invoking it.
• Use a lockfile and npm integrity metadata where the installation model permits it.
• Verify package provenance, publisher identity, release signatures, and checksums before recommending an update.
• Evaluate installation with lifecycle scripts disabled, such as npm install --ignore-scripts, when compatible with the package.
• Run the tools as a non-privileged user and never install them with sudo or an administrative account.
• Store credentials with restrictive filesystem permissions and use narrowly scoped, revocable API credentials where supported.
• Review new package versions before changing the pinned version, rather than automatically tracking the latest release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill recommends launching an MCP server via npx -y @wavespeed/mcp without pinning a specific version or integrity source. That creates supply-chain risk because a future compromised or malicious package version could be fetched and executed automatically at runtime, especially since npx installs and runs code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to upload local files and discusses downloadable outputs, but it does not clearly warn that local media will be transmitted to a third-party service and that generated files may be written to disk. In an agent setting, this can lead to accidental disclosure of sensitive local content or unexpected filesystem side effects if the operator is not explicitly informed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.