Seedance 2.5 图生视频

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:06 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated AI Hive image-to-video purpose, but it needs Review because API keys and selected media can be sent to unvalidated custom destinations.

Install only if you trust AI Hive and understand that selected images, video, or audio will be uploaded for generation and that jobs may incur account charges. Do not use --base-url, AI_HIVE_BASE_URL, or a config base_url unless you fully trust that endpoint, because the current script can send your API key and selected media through it. Use a dedicated API key with limited exposure and review ~/.ai-hive/config.json after initialization.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:100

Finding

Arbitrary API Base URL Can Expose the Bearer API Key

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py:100-111, 130-145, 587
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

Vulnerable Code

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

def _url(self, path):
    return f"{self.base}/openapi/v1/{path}"

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

python

parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")

Technical Analysis

The API endpoint can be supplied through a command-line argument, the AI_HIVE_BASE_URL environment variable, or the persistent configuration file. The value is accepted without requiring HTTPS or validating the destination host against an allowlist.

The HTTP client then attaches the AI Hive bearer token to every request made through that base URL. Consequently, control over any base URL input is equivalent to control over the destination to which the API credential is transmitted.

This is not an automatic compromise under normal use because the legitimate default endpoint is HTTPS. Exploitation requires influence over the invocation, environment, or configuration file. Nevertheless, automation wrappers, copied command ...[truncated 1259 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the base URL to use HTTPS.
2. Allowlist the documented production hostname, ai-hive.iclip.cn, for ordinary operation.
3. If custom endpoints are necessary for development, require an explicit opt-in flag and display a warning before transmitting credentials.
4. Parse URLs with urllib.parse.urlparse and reject embedded credentials, fragments, malformed hosts, and unexpected ports.
5. Disable redirects for authenticated API calls or validate every redirect destination before forwarding the Authorization header.
6. Consider separating production credentials from credentials permitted for custom development endpoints.
7. Protect the configuration directory as well as the configuration file and document that configuration integrity is security-sensitive.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:277

Finding

Unvalidated Upload Instructions Can Redirect User Media

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py:277-291
Vulnerability Type: Unvalidated server-controlled file upload destination
Risk Level: Medium

Vulnerable Code

python

media_id = token["mediaId"]
upload_url = token["upload"]["url"]
upload_method = token["upload"].get("method", "PUT")
upload_headers = token["upload"].get("headers", {})

# PUT to OSS — do not carry API Key; use returned headers
print(f"[2/3] Uploading file to object storage...")
with open(str(path), "rb") as f:
    try:
        oss_resp = requests.request(
            upload_method, upload_url, headers=upload_headers,
            data=f, timeout=300,
        )
    except requests.exceptions.RequestException as e:

Technical Analysis

The upload-token response controls the destination URL, HTTP method, and request headers used to transmit the complete contents of a user-selected local file. The client does not validate the URL scheme, destination hostname, port, method, or redirect behavior.

Presigned object-storage uploads commonly require server-provided URLs and headers, so accepting dynamic upload instructions is expected functionality. The security defect is the absence of trust-boundary validation around those instructions. If the API endpoint or its response is compromised, or if a custom base URL is configured, it can return instructions that cause the selected media to be uploaded to an unrelated destination.

The code intentionally omits the AI Hive API key from the object-storage request, which limits credential exposure. However, the local file content itself remains exposed.

Attack Path

1. An attacker controls or impersonates the configured API endpoint, including through the arbitrary base URL behavior described separately.
2. The victim runs generate or upload with a private image, video, or audio file.
3. The malicious endpoint returns an upload-token response containing a ...[truncated 934 chars]

Remediation

View remediation

Remediation Suggestions

1. Require upload URLs to use HTTPS.
2. Maintain an allowlist of documented object-storage domains or validate upload destinations against trusted metadata supplied through a securely authenticated channel.
3. Restrict upload methods to the minimum expected set, preferably PUT and only any other methods explicitly required by the service.
4. Reject URLs containing embedded credentials, unexpected ports, loopback addresses, link-local addresses, or private network destinations unless explicitly supported.
5. Disable automatic redirects for file uploads or validate each redirect target before resending the request body.
6. Validate returned headers against an allowlist and reject dangerous or unexpected header names.
7. For destinations outside the expected storage domains, require informed user confirmation showing the exact hostname and file being transmitted.
8. Document the remote upload behavior clearly so users understand that selected media leaves the local system.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:173

Finding

Unpinned Third-Party Dependency Installation Is Not Reproducible

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:173-178 and scripts/videogen.py:7, 19-22
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

markdown

### 1. Install dependencies

```bash
pip3 install requests

text

```python
try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command resolves requests and its transitive dependencies without a pinned version or integrity hashes. The installed code therefore depends on the package versions and package index state at installation time.

The package name is legitimate and there is no evidence that this project intentionally introduces a malicious or typosquatted dependency. The risk arises from non-reproducible dependency resolution, potentially unsafe custom pip indexes, future compromised releases, and unreviewed transitive dependency changes.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. Pip contacts its configured package index, which may be the official index or an organization-specific or attacker-influenced mirror.
3. Pip resolves the latest compatible package and transitive dependency versions without checking project-provided hashes.
4. A compromised package source or malicious dependency release supplies altered code.
5. That code executes during installation or later when videogen.py imports and uses requests.

Impact Assessment

A malicious dependency executes with the privileges of the user running pip or the Skill. Depending on those privileges, it could read user-accessible files and environment variables, steal the AI Hive API key, modify local files, or make arbitrary network requests.

The practical likelihood is reduced because requests is a well-established package and no un ...[truncated 171 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests to a reviewed version or a narrowly controlled compatible range.
2. Provide a lock file or requirements file containing cryptographic hashes, and install with pip --require-hashes.
3. Pin and hash transitive dependencies where reproducible deployment is required.
4. Document the trusted package index and avoid untrusted extra indexes.
5. Recommend installation inside a dedicated virtual environment rather than the global Python environment.
6. Add automated dependency scanning and a controlled update process so security fixes can be adopted without silently accepting unrelated future versions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation describes capabilities that can access environment variables, read and write local files, use the network, and execute shell commands, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this increases the chance of over-privileged execution, unintended file/system access, or network actions occurring without transparent user or platform controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description contains a very large set of broad trigger terms spanning generic video generation, many competitor products, ecommerce platforms, and marketing use cases. This can cause the skill to activate for loosely related user queries, increasing the risk of unintended execution paths that perform uploads, API calls, or file writes when the user did not specifically request this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The applicable-user section defines the target audience and matching terms so broadly that it effectively invites activation for almost any Chinese or English user asking about video generation. In context, this is more dangerous because the skill is not merely informational: it can initialize credentials, upload media, submit jobs, poll tasks, and download files, so overbroad matching can trigger costly or privacy-relevant actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file begins as a generic AI Hive CLI supporting chat, image generation, model listing, uploads, and arbitrary video operations, even though the skill is presented as a narrowly scoped Seedance 2.5 image-to-video skill. In an agent-skill context, extra reachable capabilities increase attack surface and can let users or orchestrators invoke unintended APIs, violating least privilege and potentially bypassing policy or product constraints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring explicitly advertises a general-purpose AI capability wrapper, which contradicts the declared fixed-purpose Seedance 2.5 image-to-video behavior. This mismatch is dangerous because maintainers, reviewers, or automated systems may trust the manifest while the codebase still contains broader functionality, making hidden or accidental capability exposure more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and user-facing instructions are written entirely in Chinese, and subsequent prompts/messages throughout the script also assume Chinese output and interaction. For a general-purpose skill, this is a natural-language locale constraint without opt-in or justification, which matches the policy-violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese throughout the substantive changelog entries, which effectively forces a specific language for users reading the skill documentation. Under the policy criteria, a language constraint should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The text limits the intended audience to users searching in Chinese or English, but it does not indicate that other languages are supported via user choice or explain why this locale restriction is necessary. This can be read as a language/locale constraint without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.