Seedance 2.5 参考音频生视频

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its video-generation purpose, but needs Review because it can forward your API key to any configured API server and trusts server-provided filenames when writing downloads.

Install only if you trust the AI Hive endpoint and understand that local media you name will be uploaded for generation. Avoid setting --base-url or AI_HIVE_BASE_URL unless you control and trust that endpoint, keep the API key scoped/revocable, and use a dedicated output directory for downloads.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/videogen.py:99

Finding

Unrestricted API Base URL Can Expose Bearer Credentials and Sensitive Request Data

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py, lines 99-141
Vulnerability Type: Unrestricted credential forwarding to a configurable endpoint
Risk Level: High

Vulnerable Code

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

def _url(self, path):
    return f"{self.base}/openapi/v1/{path}"

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

The corresponding command-line option is registered at lines 608-609:

python

parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")

Technical Analysis

The API endpoint can be supplied through --base-url, the AI_HIVE_BASE_URL environment variable, or the local configuration file. The value is accepted without validating its scheme, hostname, port, user-information component, or destination.

AiHiveClient subsequently attaches the API key as a bearer token to every request made to that endpoint. Consequently, any selected server receives the API credential. API requests may additionally contain prompts, filenames, media metadata, model parameters, pricing information, and task identifiers.

Plain HTTP endpoints are also accepted. In that case, credentials and request content ma ...[truncated 1490 chars]

Remediation

View remediation

Remediation Suggestions

1. Allow only the documented production origin by default, such as https://ai-hive.iclip.cn/api.
2. Parse endpoints with urllib.parse.urlsplit() and require:
   • The https scheme.
   • An explicitly approved hostname.
   • No embedded username or password.
   • No fragment.
   • Only expected ports.
3. Do not attach the production API key to an endpoint outside the approved origin.
4. If custom endpoints are a necessary development feature, place them behind an explicit development-only option and require separate credentials.
5. Reject plaintext HTTP even for configuration-file and environment-variable values.
6. Warn clearly before transmitting prompts or media metadata to a non-default endpoint.
7. Consider restricting or ignoring AI_HIVE_BASE_URL in production automation where environment variables may be injected by less-trusted components.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:386

Finding

Server-Controlled Task Fields Can Cause Output Path Traversal and Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py, lines 386-399
Vulnerability Type: Path traversal through untrusted output filename components
Risk Level: Medium

Vulnerable Code

python

out_dir = Path(output_dir)
out_dir.mkdir(parents=True, exist_ok=True)
task_type = task.get("taskType", "task")
for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

The same untrusted task_type value is also used for the last-frame output:

python

for item in succeeded:
    last_frame = item.get("lastFrameUrl")
    if last_frame:
        out_path = out_dir / f"{task_type}_{task_id}_lastframe.png"
        download_file(last_frame, out_path)

download_file() opens the resulting path in overwrite mode:

python

with open(str(out_path), "wb") as f:
    for chunk in resp.iter_content(chunk_size=8192):
        if chunk:
            f.write(chunk)

Technical Analysis

taskType is obtained from an API response and task_id may originate from a previous generation response. Both values are interpolated directly into a local filename without removing path separators, rejecting traversal components, or confirming that the resolved path remains under output_dir.

A malicious value containing ../, platform-specific separators, or an absolute-path prefix can cause Path composition to identify a destination outside the intended output directory. The destination is then opened with wb, which truncates an existing file before writing downloaded content.

The result URL is also supplied by the API, and the download has no maximum-byte limit. A compromised endpoint could therefore combine path traversal with attack ...[truncated 1370 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not derive local paths directly from server-controlled task fields.
2. Generate output names locally using a UUID, numeric index, and a fixed extension.
3. If task metadata must be retained, sanitize each component with a strict allowlist such as ASCII letters, digits, underscores, and hyphens.
4. Resolve both the output directory and candidate destination, then verify the destination is a descendant of the output directory before opening it.
5. Use exclusive file creation where overwriting is unnecessary, or require explicit confirmation before replacing an existing file.
6. Apply a maximum download size while streaming and abort if either Content-Length or accumulated bytes exceed that limit.
7. Validate download URL schemes and, where practical, restrict downloads to expected storage domains.
8. Avoid using the same last-frame filename for multiple completed items; include a safe local index to prevent accidental overwrites.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:224

Finding

Dependency Installation Instructions Do Not Pin or Verify Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 224-228
Vulnerability Type: Unpinned and unverifiable third-party dependency installation
Risk Level: Low

Vulnerable Code

bash

pip3 install requests

Technical Analysis

The installation instructions request the latest package version available from the active Python package index. No reviewed version constraint, hash verification, lock file, index restriction, or isolated environment is specified.

This makes installations non-reproducible and allows the effective dependency set to change without a corresponding change to the Skill. It also inherits trust from the user's configured package index and from mutable transitive dependency resolution.

The project references the legitimate requests package rather than an apparent typosquat. Therefore, this is a supply-chain hardening weakness rather than evidence that the Skill intentionally introduces a malicious dependency.

Attack Path

1. A user follows the documented pip3 install requests command.
2. pip queries the user's configured package index and resolves the package and transitive dependencies available at that time.
3. If the index, package release, account, or dependency chain is compromised, malicious package code may be installed.
4. The code executes during installation where package build steps are required, or when videogen.py imports and uses the dependency.

The attack requires compromise or malicious configuration of the package supply chain; the repository itself does not contain such a payload.

Impact Assessment

Malicious dependency code would run with the privileges of the user performing installation or executing the Skill. It could access files, environment variables, the AI Hive API key, prompts, and media available to that user.

With ordinary user-level installation, the impact is generally limited to that account. Running the installation with e ...[truncated 77 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency file with an exact requests version and pinned transitive dependencies.
2. Include cryptographic hashes and install with pip install --require-hashes -r requirements.txt.
3. Use a lock-file workflow and automated dependency vulnerability scanning.
4. Instruct users to create an isolated virtual environment rather than installing into the system Python environment.
5. Specify the intended trusted package index and avoid elevated installation.
6. Establish a controlled update process so dependency upgrades are reviewed, tested, and committed explicitly.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Although the skill is declared as a Seedance audio-reference-to-video tool, the codebase still contains unrelated generic capabilities such as chat, image generation, model enumeration, account queries, and arbitrary media upload flows. In a skill environment, exposing latent off-purpose capabilities expands the attack surface and may allow an agent or caller to perform actions beyond the user’s expected consent boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing natural-language content entirely in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents and encourages capabilities that imply file access, environment access, network requests, and shell execution, but it does not declare any tool scope or permission boundaries. This creates a least-privilege violation: an agent may invoke the skill without clear user-visible constraints, increasing the chance of overbroad access to local files, API keys, or network destinations during normal use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description uses very broad trigger terms covering generic video generation, many competitor products, and many e-commerce platforms, making the skill likely to activate on loosely related user requests. Overbroad routing can cause unintended execution of a capability-bearing skill, exposing local files, credentials, or network actions in contexts where the user did not specifically request this tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description is predominantly written in Chinese and specifically mentions matching Chinese or English users later, but there is no explicit user-facing language choice or statement that outputs can follow the user's preferred language. Under the policy, forcing or implicitly defaulting to a specific language without opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage-scope sections repeatedly define expansive matching based on comparisons, migration intent, e-commerce roles, platforms, and content-production scenarios, without clear boundaries. In combination with upload/download, API key setup, and task execution behavior, this increases the risk of accidental invocation and unintended data handling beyond the user's actual request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents itself as a generic AI Hive tool in its module documentation, while the actual executed entrypoint is a constrained Seedance 2.5 audio-reference-to-video skill. This mismatch can mislead reviewers, orchestrators, or policy controls into granting broader trust than the skill’s declared purpose warrants, which is a security-relevant integrity issue in a skill ecosystem.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and all user-facing guidance are written in Chinese, presenting the tool as a general-purpose skill rather than a region-specific or Chinese-only skill. Under the policy, a skill that effectively constrains interaction to one language should either offer user choice or clearly justify the locale limitation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill includes a user-info endpoint that can retrieve account information and wallet balance, which is unnecessary for the stated purpose of generating Seedance audio-driven videos. Even if only informational, this creates avoidable access to sensitive account metadata and can enable privacy leakage or reconnaissance about the user’s billing state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Generic text chat is unrelated to the declared audio-reference-to-video workflow, yet the skill retains a fully functional text-chat API path. This broadens the effective permissions and enables unintended model access under the guise of a narrow video-generation skill, undermining least privilege and user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Standalone image generation is outside the stated purpose of a Seedance audio-reference-to-video skill, but the code preserves a direct image-generation path. This capability creep matters because it gives callers a broader set of model actions than the skill contract advertises, increasing misuse potential and review blind spots.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The CLI help and comments still advertise a broad multi-capability AI Hive tool, while the actual runtime path is a fixed Seedance 2.5 audio-reference-to-video workflow. In security review terms this is dangerous because operators may rely on help text and comments to understand authority, causing incorrect trust decisions and inadequate control of hidden or legacy capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that language choice is optional or that the file is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.