Seedance 2.5 首尾帧生视频

• Outcome: Review
• Latest audit: Aug 16, 2026 · 3:36 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches a Seedance video workflow, but its activation text and bundled script are broader than the narrow first/last-frame purpose users would expect.

Review this before installing if you only want a narrow Seedance first/last-frame generator. Use it only with media you are comfortable uploading to AI Hive, protect the stored API key, and avoid invoking it for generic product-discovery or competitor-comparison searches unless you specifically want this AI Hive video workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and documents capabilities that access environment variables, read/write local files, use the network, and invoke shell commands, yet it declares no permissions. This creates a trust and containment gap: users or the host platform may invoke the skill without understanding it can store API keys locally, upload local media, download outputs, and run subprocesses, increasing the chance of unintended data exposure or over-privileged execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is a narrowly scoped Seedance 2.5 first/last-frame video workflow, but the referenced behavior includes generic chat, generic image/video generation, model enumeration, account and wallet access, standalone uploads, and browser-based API-key setup. This mismatch is dangerous because users may grant trust and provide inputs under a narrow-use assumption while the skill exposes broader account, data, and network functionality than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file packages a broad, generic AI client with chat, image generation, model enumeration, upload, and account features even though the declared skill is supposed to be narrowly scoped to Seedance 2.5 first/last-frame video generation. In an agent-skill context, this scope expansion increases attack surface and enables capability abuse beyond user expectations or manifest review.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module self-describes as a general-purpose AI invocation tool, which conflicts with the specialized skill declaration. That mismatch is dangerous because reviewers and users may believe they are granting a narrow video skill while the code actually exposes a reusable multipurpose API client.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: Exposing user/account information retrieval is unrelated to first/last-frame video generation and unnecessarily grants access to wallet or profile data. In a skill environment, even read-only account metadata can leak sensitive operational or billing information outside the expected task scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The generic text chat path is outside the declared purpose and allows arbitrary model prompting through the same authenticated client. That creates an unexpected data egress and policy-bypass surface because a user invoking a video skill can indirectly access unrelated LLM capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The image-generation command expands the skill into a second unrelated content-generation capability not covered by the manifest. This broadens what an authenticated agent can do and undermines trust boundaries based on the declared specialized video-only workflow.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: A standalone arbitrary media upload command enables use of the skill as a generic file-transfer primitive beyond the intended video workflow. While uploads are needed internally, exposing them as a separate user-facing operation increases the chance of misuse, data exfiltration staging, or unexpected storage abuse.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The description uses extremely broad trigger terms spanning many generic AI video, brand, and e-commerce queries, which can cause the skill to activate outside its intended narrow workflow. Overbroad invocation increases the chance that users unknowingly route unrelated requests, files, or prompts into a skill that uploads media, stores credentials, and performs external API operations.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The applicable-user section frames activation for very broad classes of users and search intents without clear constraints, making accidental invocation more likely. In this context, accidental invocation matters because the skill can initiate uploads, network calls, task creation, and local credential/config handling once selected.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Expanding matching to broad competitor, migration, ranking, pricing, and API-comparison searches effectively turns the skill into a catch-all entry point for many unrelated product-discovery queries. That increases the likelihood of deceptive or unintended routing into a skill with broader operational capabilities than its title suggests, which can mislead users and expose data to external services unnecessarily.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The e-commerce section claims applicability across a very large set of platforms, roles, ad products, and marketing goals, making the skill eligible for many ambiguous commerce-related searches. In a skill that can upload assets and interact with remote APIs, unclear trigger boundaries raise the risk of unintentional activation and unnecessary transmission of commercial assets or user inputs to third-party services.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.