Security audit

Seedance 参考音频生视频

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real AI Hive video-generation skill, but its activation scope is much broader than its paid media-upload workflow warrants.

Install only if you intentionally want AI Hive to receive the media and prompts you provide for Seedance video generation. Avoid using it for generic AI-video research or price comparisons unless you explicitly choose to run the workflow, prefer an isolated virtual environment with pinned dependencies, and treat the local AI Hive API key as a paid credential.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:176
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/videogen.py:649
Finding: API Key Written Before Restrictive File Permissions Are Applied
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documents and encourages capabilities equivalent to shell execution, network access, environment/config handling, and file writes, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this weakens least-privilege controls and makes it easier for the skill to be invoked with broader-than-necessary access to local files, credentials, and network operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description contains extremely broad trigger terms spanning generic AI video generation, competitor names, pricing, APIs, and e-commerce contexts, which can cause the skill to activate for loosely related requests. Over-broad routing can misdirect user intent, expose unnecessary tool use, and increase the chance that file/network-capable automation runs when a simple informational answer would have been sufficient.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The description explicitly targets '中文或英文用户' while the skill title and body are primarily Chinese, implying a default locale expectation without offering the user a language choice. Under the policy, language constraints should be opt-in or clearly justified; here the file does not state that users may choose their preferred language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The related-tools and e-commerce sections broaden invocation scope to many brands, platforms, and business scenarios without clear boundaries or disambiguation logic. In context, this makes the skill more dangerous because it is paired with operational behaviors such as uploading media, writing config files, polling tasks, and downloading outputs, so ambiguous triggering can lead to unintended external data transfer or local side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file implements a broad, reusable AI Hive client with chat, image generation, model listing, uploads, user-info, and generic video operations, while the declared skill is narrowly scoped to Seedance audio-reference-to-video. This overbroad functionality increases the attack surface and makes it easier for downstream wrappers, maintainers, or accidental invocation paths to use capabilities outside the approved scope, undermining least-privilege and skill-boundary assumptions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level documentation presents the module as a generic AI capability invocation tool, which conflicts with the fixed skill configuration later in the file. In security-sensitive automation, misleading docs are dangerous because reviewers and integrators may trust the declared skill scope while the codebase actually contains broader capabilities that can be exposed or reused unintentionally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring is entirely in Chinese and presents the skill as a general-purpose AI utility, while later CLI prompts and messages are also Chinese-only. For a general skill, this constitutes a language/locale policy issue because the file does not offer user opt-in or an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing natural-language content entirely in Chinese across multiple changelog entries. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may use a preferred locale, so this appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code includes a user-info endpoint and CLI command that queries user information and wallet balance. That capability is not part of the manifest’s stated purpose of generating Seedance reference-audio videos and is not necessary to upload media, submit jobs, poll status, or download outputs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.