T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:91- Finding
Bearer Credential Disclosure Through an Unrestricted API Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance2.5 视频生成与编辑
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a real AI Hive video-generation tool, but it asks for broad activation and handles API keys, uploads, and billable generation with weak endpoint scoping.
Install only if you intend to use AI Hive for Seedance2.5 video work. Avoid using `--base-url` or `AI_HIVE_BASE_URL` unless you fully trust the endpoint, prefer a dedicated low-limit API key, review costs before batch jobs, and be deliberate about which local media files are uploaded.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:646- Finding
Non-Atomic API Key File Creation Temporarily Exposes Plaintext Credentials
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:180- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` 2. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use an isolated virtual environment instead of installing into the system interpreter. 4. Document an approved package index and require TLS certificate verification. 5. Periodically review and update the pinned version after vulnerability and compatibility testing. 6. Consider publishing a lock file or reproducible build metadata covering transitive dependencies as well as the direct `requests` dependency. ]]>
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents its substantive instructions and release notes exclusively in Chinese, with no indication that the skill is region-specific or that users can choose another language. That can violate language/locale policy requirements when a skill implicitly forces a language without user opt-in.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises operational behavior that includes reading environment/configuration, writing files, making network requests, and invoking shell commands, but it declares no explicit tool scope or permission boundaries. In an agent platform, that mismatch can lead to over-privileged execution, making unintended file access, secret exposure, or arbitrary external requests more likely if the skill is triggered in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description contains extremely broad trigger terms covering many generic video, AIGC, e-commerce, and competitor-product queries. That can cause the skill to be invoked for loosely related user requests, creating an attack surface where a networked, file-writing skill runs unexpectedly and may handle unrelated user data or perform costly actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation explicitly broadens scope to comparison, migration, API access, and alternative-tool searches across a large set of unrelated products and companies. This increases the chance of unintended activation outside the core task, which is risky because the skill can upload media, call external APIs, save task identifiers, and download outputs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The e-commerce targeting section enumerates a very large set of platforms, merchant roles, ad products, and content formats, making invocation plausible for many ordinary commerce or advertising requests. In context, that broad matching is more dangerous because the skill is not purely informational: it can perform external uploads, store API keys, submit billable jobs, and write files on disk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring is entirely in Chinese and presents the skill as a general-purpose tool, but it does not indicate that Chinese is optional or that other languages are supported for instructions and user-facing output. This creates a natural-language policy concern because the skill effectively imposes a locale preference without explicit user opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The document is written entirely in Chinese and does not explicitly offer a language or locale choice for users. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example API key value uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose another language, so this is a natural-language locale policy issue.
- Content
Static analysis
No suspicious patterns detected.