ClawHub
Back to skill

Security audit

Seedance2.0 视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI Hive video-generation helper that uploads user-selected media, stores an API key locally, and downloads generated videos.

Install only if you are comfortable sending prompts and selected media files to AI Hive, storing an AI Hive API key locally, and potentially incurring API charges when generation tasks are submitted. Avoid passing sensitive local files to upload/generate unless you intend to upload them.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions while its documented behavior clearly involves environment access, local file read/write, network calls, and shell/Python execution. This weakens user consent and platform enforcement because a user invoking a video skill may not realize it can persist API keys locally, access files for upload, and make arbitrary outbound requests.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is presented as a narrowly scoped Seedance2.0 video generator, but the analysis indicates broader capabilities such as general AI Hive OpenAPI access, listing arbitrary models, chat/image generation, wallet/user info queries, and browser-assisted API key acquisition/storage. This scope mismatch is dangerous because it can be used to obtain broader account access and perform actions the user did not reasonably expect from the declared purpose.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.