Security audit

Seedance 2.5 电商视频

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI video-generation helper that uploads user-selected product media to AI Hive and saves generated clips locally.

Before installing, be aware that using the clip command will upload the product images or videos you name to AI Hive and may save generated videos under ~/Downloads/AiHive unless you choose another output directory or --no-download. Prefer an environment variable for the API key if you do not want it stored in ~/.ai-hive/config.json, and use --preview to inspect prompts before any upload or billing.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill instructs users to run local Python commands, install dependencies, use API keys, read/write local files, and make network requests, yet it declares no permissions. This creates a trust and review gap: users or platforms may underestimate the skill's actual access to the filesystem, environment variables, shell, and external services, increasing the risk of unintended data exposure or unsafe execution.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.