T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:101- Finding
API Key Disclosure Through an Unrestricted Custom Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance 2.5 文生视频
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its video-generation purpose, but unsafe API endpoint and download handling could expose an AI Hive key or overwrite local files if a malicious or compromised endpoint is used.
Review this skill before installing. Use only the default AI Hive endpoint unless you fully trust a custom endpoint, avoid passing API keys on the command line, keep the saved config file private, run it from an isolated environment, and choose an output directory where accidental overwrites are low impact.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:399- Finding
Path Traversal and Arbitrary File Overwrite Through Server-Controlled Task Fields
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:275- Finding
Unvalidated API-Provided Upload and Download Destinations
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:166- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains user-facing natural-language content in a single language, which can constitute a language/locale policy violation when no opt-in or locale justification is provided. The file does not indicate that the skill is region-specific or that users may choose another language.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents and encourages capabilities that imply network access, local file read/write, environment/config access, and shell execution, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this can lead to over-privileged execution where the skill may access sensitive local data, write configuration files, or invoke commands beyond what is necessary for the user’s task.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation description is extremely broad and includes generic comparison, alternative-tool, pricing, API, and workflow-migration queries across many unrelated video platforms. This creates an over-triggering risk where the skill may activate in contexts that do not require executing a video-generation workflow, causing unintended network calls, task submission, or credential-handling for loosely related user queries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Treating broad e-commerce platform names, seller roles, ad products, and marketing terms as activation signals can cause the skill to run for general commerce discussions unrelated to this tool. In context, that increases the chance of inappropriate tool execution, unnecessary API usage, and accidental exposure of local files or credentials when the user only wanted advice, comparison, or platform information.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file embeds a full generic AI Hive client with chat, image, model enumeration, upload, and task-management capabilities even though the declared skill is Seedance 2.5 text-to-video. This expands the accessible attack surface and violates least-privilege expectations: a caller using this skill may gain unintended access to unrelated AI operations, including arbitrary media upload and model discovery, if the surrounding platform exposes the script as shipped.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and user-facing CLI text are written in Chinese, and later prompts/errors continue this pattern, making the skill effectively Chinese-only. The file does not offer users a language/locale option or explain that the skill is intentionally region- or locale-specific, which conflicts with the language-choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description states that users only need to input a Chinese or English description, which imposes a language constraint in natural language. The file does not offer an opt-in choice for other languages or explain why the limitation is required, so it may violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The sample API key value uses Chinese text ('请替换为你的APIKey') in a user-facing configuration example. This imposes a specific language in the file without any opt-in, alternative locale, or documented reason that the skill is region-specific.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill parser exposes standalone task lookup and media upload commands that are not described in the manifested text-to-video purpose. Even if individually legitimate, undocumented operational capabilities let users interact with backend resources outside the advertised workflow, increasing the chance of misuse, unexpected data exposure, or policy bypass in environments that rely on manifest scope for trust decisions.
- Content
Static analysis
No suspicious patterns detected.