T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Promotional Skill Selection Hijacking Through Overbroad Activation Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance2.5 最低 8 折｜比官方更便宜的视频生成渠道
Security checks for vulnerabilities and agentic risk
Overview
The skill performs a real AI Hive video-generation workflow, but it is overbroadly promoted and has unsafe handling of credentials, downloads, and billable API actions that users should review before installing.
Install only if you specifically want AI Hive to handle Seedance 2.5 generation and are comfortable sending prompts and selected media to that service. Use a scoped or low-balance API key if possible, avoid custom base URLs unless you control them, review costs before submitting jobs, and keep output directories away from sensitive files until filename sanitization is fixed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:399- Finding
Arbitrary File Overwrite Through Unsanitized Remote Task Metadata
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:91- Finding
API Key Disclosure Through Unrestricted Custom Base URLs
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:191- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content in this markdown file is overwhelmingly written in Chinese, with no indication that users can choose another language or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and documents capabilities that perform network access, file reads/writes, environment access, and shell execution, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this can lead to over-privileged execution, where the skill may access secrets, local files, or external services beyond what users reasonably expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description uses very broad activation phrases covering generic video generation, editing, pricing, alternatives, APIs, and e-commerce content requests. This makes the skill likely to trigger for many unrelated user intents, increasing the chance that an over-privileged skill is invoked unexpectedly and performs uploads, network calls, or file writes without sufficiently precise user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The applicability section expands the trigger surface to competitor comparisons, migration, API access, and domestic availability searches across many third-party products. This broadens the activation scope far beyond a narrowly defined Seedance execution skill, which can cause accidental invocation in contexts where users only want information rather than a tool that uploads media and submits paid jobs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The e-commerce coverage lists an extremely broad set of platforms, roles, objectives, ad products, and content terms, making the trigger scope ambiguous and overly expansive. In context, this is more dangerous because the skill can initialize credentials, upload user media, submit remote jobs, and download outputs, so accidental activation may lead to unintended data transfer or cost-incurring actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and all user-facing guidance are written exclusively in Chinese, presenting the tool as a general-purpose skill rather than a region-specific or Chinese-only skill. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest text is primarily written in Chinese and explicitly references Chinese or English users, but it does not state that the user can choose their preferred response language. This can create a language-policy issue if the skill defaults to a specific language or locale without explicit opt-in.
- Content
Static analysis
No suspicious patterns detected.