Seedance 2.5 图生视频

• Outcome: Review
• Latest audit: Aug 16, 2026 · 3:21 PM UTC
• Version: 1.0.0

Overview

The skill mostly does the advertised video-generation work, but its trigger scope is much broader than the side-effectful API, upload, credential, and billing actions it can perform.

Review before installing. Use this skill only when you intend to upload selected media to AI Hive and submit a Seedance 2.5 image-to-video task. Prefer explicit commands and avoid letting broad competitor, ecommerce, or pricing research prompts trigger operational generation. Store the API key carefully and monitor any generated-task costs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and documents capabilities that read environment variables, write configuration files, access the network, and invoke shell commands, but it does not declare permissions. This reduces transparency and weakens policy enforcement because users and the platform cannot easily distinguish expected behavior from overreach, especially given the init flow that opens a browser and persists secrets locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is presented as a narrowly scoped Seedance 2.5 image-to-video tool, but the documented behavior includes broader model discovery, upload tooling, account-related queries, initialization flows, and more general media-generation plumbing. This mismatch can cause the skill to be invoked in contexts where users do not expect broader data access, external calls, or account interaction, increasing the risk of unintended actions and data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file is implemented as a generic AI Hive client supporting chat, image, video, model listing, uploads, and account queries, while the declared skill is specifically Seedance 2.5 image-to-video. This capability overreach expands what the agent can do if invoked directly or repurposed, violating least-privilege and increasing attack surface beyond the advertised function.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: Exposing a user/account information endpoint in a media-generation skill is unnecessary and increases access to billing or account metadata. Even if it only returns the current account's details, it enlarges the skill's data access beyond user expectations and can leak sensitive operational information.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The generic text chat feature is unrelated to a fixed image-to-video skill and allows arbitrary model interactions under the same API key. That broadens the skill from a narrowly scoped media workflow into a general-purpose AI client, increasing the chance of misuse, data exposure, or unexpected spend.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Standalone image generation exceeds the stated Seedance 2.5 image-to-video scope and creates additional unneeded capability. This increases attack surface and cost exposure because a user or downstream agent can invoke unrelated generation workflows not implied by the skill manifest.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module docstring explicitly presents the file as a general AI capability tool, which is consistent with the code but contradicts the skill's declared fixed-purpose intent. This mismatch is dangerous because reviewers and users may trust the narrow manifest while the shipped implementation enables substantially broader operations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description includes an unusually broad set of trigger terms spanning many generic video, AI, commerce, and competitor-product searches. Overbroad invocation criteria can cause the skill to activate for loosely related user requests, creating opportunities for unintended file uploads, network activity, or account-linked operations in contexts where the user did not specifically request this tool.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The applicable-user section expands targeting to very generic bilingual search phrases without clear limits on when the skill should not run. In a skill that can upload media, query remote services, and store credentials, ambiguous activation materially increases the chance of accidental execution beyond the user's intended scope.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The related-tools and migration section broadens the skill to large sets of competitor, platform, workflow, and pricing queries without meaningful constraints. Because the skill can perform external interactions and credential-related setup, this expansive scope makes it more likely to be invoked for research or comparison prompts where users did not intend operational actions, increasing risk of over-collection and unintended side effects.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.