ClawHub
Back to skill

Security audit

Seedance 2.5 产品宣传视频

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI Hive product-video helper that uploads only user-specified product assets and stores credentials only when the user runs its auth command.

Install only if you are comfortable sending selected product images or reference videos to AI Hive for generation. Prefer --preview before submitting, use AI_HIVE_API_KEY if you do not want a saved key, and remove ~/.ai-hive/config.json if you no longer want the credential stored locally.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/product_film.py:196
Finding

Unrestricted Server-Controlled Asset Upload Destination

Content
View full analysis
", media_id) return media_id ``` ### Technical Analysis The upload ticket returned by the remote AI Hive API controls the destination URL, HTTP method, and request headers used to transmit a local product image or motion-reference video. The client validates only that the URL uses the `https` scheme. HTTPS protects data while in transit but does not establish that the receiving hostname is an authorized storage service. Any HTTPS endpoint is accepted, including an attacker-controlled domain. The code also accepts an arbitrary method through `transfer.get("method", "PUT")`, forwards arbitrary server-supplied headers, and relies on the default redirect behavior of `requests`. This creates a trust-boundary weakness: a compromised, malicious, or incorrectly configured upload-ticket response can cause the client to disclose a user-selected local asset to an unintended third party. The code does not per ...[truncated 1654 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents shell commands, package installation, networked API use, local file access, and API key handling, but it does not declare any explicit tool scope or allowed-tools boundary. That mismatch increases the chance an agent will invoke filesystem, shell, environment, or network capabilities more broadly than intended, especially when the skill is auto-discovered or auto-executed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The metadata and description use very broad trigger language covering many generic product-video terms, platforms, and competitor model names. This can cause the skill to be invoked in contexts the user did not intend, increasing the risk of unintended file handling, shell execution, or API submissions under an overly broad matching surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The natural-language instructions and examples are presented entirely in Chinese, and the file does not state that users may choose another language or locale. Under the policy, a forced language without opt-in can be a locale/language policy violation unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring is written as an instruction/purpose statement entirely in Chinese, and all user-facing messages and CLI help throughout the file are also fixed to Chinese. This indicates a language constraint without offering the user a language choice or documenting that the tool is region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script persists the AI Hive API key to a predictable local file under the user's home directory. Although it attempts to set permissions to 0600, it does so without clearly warning the user that long-lived credentials will be stored on disk, which increases exposure on shared systems, backups, or compromised user accounts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The placeholder value for api_key includes Chinese-only instructional text (请替换为你的APIKey). This is a natural-language locale constraint embedded in the file and does not provide an opt-in, alternative language, or justification that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.