T08 · Insecure Dependencies
Warning
- Location
SKILL.md:169- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance 2.0 视频生成
Security checks for vulnerabilities and agentic risk
Overview
The skill is a mostly coherent AI Hive video-generation tool, but its trigger scope and endpoint handling are broader than a paid media-upload workflow should have without clearer safeguards.
Install only if you intend to use AI Hive/Seedance and are comfortable uploading selected prompts and media to that service, possibly incurring API charges. Avoid custom `--base-url` or `AI_HIVE_BASE_URL` values unless you fully trust the endpoint, and install dependencies in a dedicated environment with pinned versions where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:91- Finding
API Credential Disclosure Through an Arbitrary Configurable Base URL
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all substantive skill information in Chinese, which can amount to a language-policy issue when no user opt-in, alternative language, or justification is provided. Readers who do not use Chinese may be unable to understand operational changes or warnings conveyed by the changelog.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and documents capabilities that imply network access, file reads/writes, shell execution, and environment/config handling, but it does not declare any explicit tool scope or permissions boundaries. That creates a privilege ambiguity where a host may grant broader access than users expect, enabling API key handling, local file writes, downloads, and external requests without clear least-privilege constraints.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description uses extremely broad trigger terms spanning generic video creation, competitor comparisons, e-commerce use cases, and many platform names. This can cause over-triggering on unrelated user requests, routing users into a skill that performs uploads, API calls, and file operations when they may have only asked for general advice or comparisons.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The applicable-user section broadens invocation to generic Chinese and English search phrases like AI video, advertising, and short drama without operational boundaries. In context, this increases the chance that the skill is selected for loosely related requests and then gains access to prompts, media, uploads, and task execution flows that the user did not specifically request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The related-tools and migration section enumerates a very large set of competitor brands and comparison intents, effectively expanding the skill's trigger surface far beyond its core function. This is dangerous because it can hijack discovery for many unrelated product-comparison or migration queries and funnel them into a workflow that may upload assets, use credentials, and incur charges.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is packaged as a Seedance 2.0 video skill, but the implementation exposes a broader general-purpose AI client with chat, image generation, model enumeration, account info, upload, and task APIs. Capability mismatch increases the attack surface and can let callers invoke functions that were not justified, reviewed, or expected for this skill’s declared purpose.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The top-level documentation explicitly describes a general-purpose AI capability tool, which conflicts with the narrower declared skill intent. This kind of misleading framing can cause operators and reviewers to underestimate what the skill can actually do, weakening governance and least-privilege controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains user-facing natural-language descriptions entirely in Chinese, including the module docstring and later CLI guidance, while providing no opt-in or alternative locale selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified, which it is not here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A generic text chat endpoint is unrelated to the Seedance-specific video-generation purpose and allows arbitrary prompt content to be sent to other models. In a skill environment, this can be abused for unauthorized model use, data exfiltration through prompts, or bypassing restrictions expected to apply to this specific skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Generic image generation exceeds the declared Seedance 2.0 video role and creates an additional content-generation path not covered by the skill description. This broadens both billing and misuse risk, and can let callers perform actions outside the intended review boundary of a video-only skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The interactive init flow displays prompts, browser guidance, validation errors, and success messages only in Chinese. Because the skill does not let the user choose language or explain a justified region-specific constraint, this constitutes a language-policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example value for
api_keyincludes Chinese text (请替换为你的APIKey), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that alternative language/localization is supported.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
User-info retrieval exposes account metadata and wallet/balance information unrelated to video generation. Even if read-only, this is unnecessary data access that can leak sensitive commercial information or enable profiling of the user account beyond the skill’s stated function.
- Content
Static analysis
No suspicious patterns detected.