Security audit

AI大模型专家｜Seedance2.0 视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

The skill generally matches its video-generation purpose, but it enables broad implicit invocation for a workflow that can upload user media, store an API key, and submit billable remote jobs.

Review before installing. Use this only if you are comfortable sending selected media and prompts to AI-HIVE, storing an API key locally, and possibly incurring generation charges. Prefer explicit invocation, confirm before uploads or high-cost runs, and avoid using sensitive or proprietary media unless AI-HIVE's retention and usage terms are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation exposes capabilities that include environment access, file read/write, shell invocation, and network operations, but it declares no permissions or trust boundaries. This creates a transparency and consent problem: users may invoke a seemingly simple video-generation skill without understanding it can access local files, persist configuration, and reach remote services. In this context the behavior is expected for API-based media upload and download, but the missing permission declaration still increases the risk of unintended data exposure or overbroad execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The described purpose is a narrowly scoped Seedance2.0 video skill, but the implementation reportedly includes broader AI-HIVE functions such as generic chat, image generation, model discovery across types, and account or wallet retrieval. That mismatch is dangerous because users and reviewers may authorize the skill under a limited-use assumption while it can perform materially broader remote actions and expose additional user data. Given this is an API-integrated skill, the hidden breadth meaningfully expands the attack surface and the chance of unauthorized or surprising processing.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation/search text is broad enough to match generic comparison, migration, and unrelated tool-selection requests, which can cause the skill to trigger outside its narrowly intended scope. Over-activation is risky here because the skill can upload media, store API keys, call external services, and create billable tasks; an accidental invocation may therefore lead to unnecessary data transfer or charges. The context makes this more dangerous than a harmless search-ranking issue because the skill has operational side effects.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill says scripts will handle media upload automatically, but it does not present a prominent upfront warning that user-provided images, videos, or audio will be transmitted to a remote platform before generation. This is a privacy and consent issue: users may supply sensitive or proprietary media under the assumption of local processing, only to have it uploaded externally. Because this skill is centered on asset reuse and media handling, the omission is especially significant.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill enables allow_implicit_invocation without any visible trigger constraints, scope limits, or user-confirmation requirements. This can cause the agent to invoke a capability that uploads media, submits external jobs, stores task identifiers, and downloads outputs even when the user did not explicitly request this specific third-party action, creating risks of unintended data transfer, unexpected charges, and privacy leakage.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.