T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:91- Finding
Bearer API Key Disclosure Through an Unrestricted API Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance 2.5 首尾帧生视频
Security checks for vulnerabilities and agentic risk
Overview
This video-generation skill has a coherent purpose, but it needs review because it can send API keys to a configurable endpoint and write downloaded results using untrusted remote metadata.
Review before installing. Use this only for explicit AI Hive Seedance video-generation tasks, avoid any untrusted --base-url or AI_HIVE_BASE_URL setting, keep the output directory away from sensitive configuration files, and consider using an isolated virtual environment with pinned dependencies. Treat the API key as spend-capable and rotate it if it may have been sent to the wrong endpoint.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:399- Finding
Arbitrary File Write Through Unsanitized Task Metadata
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:180- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The changelog content is entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. This can violate language/locale policy when no opt-in or justification is provided.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents capabilities that involve environment access, file read/write, network access, and shell execution, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the risk of over-privileged execution, unintended file/network operations, and abuse if the skill is invoked on loosely related prompts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description contains extremely broad trigger phrases spanning many video tools, marketplaces, and generic content-production terms, making accidental activation likely. A skill with external-network and file-handling behavior that triggers on ordinary comparison or e-commerce queries can cause unexpected uploads, task submissions, or data handling beyond user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The applicability section targets broad searches across many competitor brands and migration/comparison intents without clear constraints tying activation to the actual skill function. This can cause the skill to intercept general product research queries and push users into an external workflow with API-key setup, uploads, and downloads they did not explicitly request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The e-commerce coverage is so expansive that normal merchant, ad, listing, or platform queries may invoke the skill even when the user is not asking to generate video. In context, this is risky because the skill supports media upload, task submission, and file output, so false-positive activation can lead to unintended processing of user assets or unnecessary credential/setup prompts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file is presented as a narrowly scoped Seedance 2.5 first/last-frame video skill, but the implementation includes a broader generic AI Hive client with text chat, image generation, model discovery, upload, and task polling primitives. Even though the exposed skill entrypoint constrains normal use, shipping broader capability than declared increases attack surface and creates reuse or invocation risk if other code paths are called directly or later re-exposed.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring describes a generic AI capability tool, which conflicts with the advertised fixed-purpose skill. This kind of scope mismatch is dangerous because reviewers and integrators may underestimate what the code can do, weakening least-privilege review and making broader capability exposure easier to miss.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains user-facing natural-language descriptions and prompts entirely in Chinese, presenting the skill as a general-purpose tool rather than a region-specific or compliance-bound one. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation when no language choice is offered.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file states that the skill will automatically upload media, poll tasks, and download results, which implies network transmission and file operations affecting user data. The changelog does not include any warning or disclosure about these behaviors or their privacy/system impact.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document states the skill is for '中文或英文用户', which imposes a language constraint in natural language but does not explicitly offer user choice or explain why other languages are unsupported. Under the policy, language constraints should be opt-in or clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users can choose their preferred language/locale.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill includes a user-info endpoint that reveals account and wallet details, which are unrelated to the stated task of generating first/last-frame videos. Unnecessary access to account metadata violates least privilege and could expose sensitive billing or account information if invoked by a user or chained tool flow.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill can enumerate available models even though its declared behavior is fixed to a specific Seedance 2.5 mode. This broadens information exposure and may aid capability discovery, policy bypass attempts, or later expansion into unintended model use if surrounding controls weaken.
- Content
Static analysis
No suspicious patterns detected.