Security audit

Seedance 参考图生视频

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for AI Hive video generation, but its activation scope and privacy guidance are too broad for a credentialed media-upload workflow.

Review before installing. Use it only when you intend to send the referenced media to AI Hive for video generation, avoid putting API keys directly in command lines or shared logs, and be careful with sensitive personal, commercial, or copyrighted media.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation describes capabilities that access environment variables, read/write local files, use the network, and invoke shell commands, yet it does not declare permissions or clearly scope those powers. This weakens user consent and platform enforcement, making it easier for a broadly-triggered skill to access secrets, upload local media, or persist data in ways the user may not expect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose is narrowly framed as Seedance reference-image-to-video generation, but the documented behavior extends into broader model discovery, generic task handling, credential setup, browser launching, and other media/chat capabilities. This mismatch increases the chance that users or an agent invoke the skill under false assumptions, while the skill performs more sensitive actions such as querying account data or interacting with broader APIs than expected.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The file clearly implements a broad AI Hive client with chat, image generation, model listing, uploads, and task handling, while the skill is presented as a narrowly scoped Seedance reference-image-to-video skill. This scope mismatch increases the attack surface and grants capabilities a caller or reviewer would not reasonably expect from the manifest, undermining least-privilege and trust in the skill boundary.

Description-Behavior Mismatch

Low

Confidence: 90% confidence
Finding: The skill exposes a user-info endpoint that can reveal account details and wallet/balance information unrelated to the advertised video-generation purpose. Even if intended for convenience, this is an unnecessary privilege expansion that leaks sensitive account metadata if an agent invokes it unexpectedly.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The text chat command provides a generic model invocation path outside the skill's declared purpose of Seedance reference-image-to-video generation. That creates an unadvertised execution channel that could be used to submit arbitrary prompts and media to other models, bypassing the intended specialization and policy assumptions around this skill.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The image generation command adds a second unadvertised capability beyond reference-image-to-video, allowing callers to invoke arbitrary image models through the same API key. In the skill context, this broadens accessible operations and billing exposure beyond what a user or orchestrator would expect from a specialized video skill.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring explicitly describes the file as a general-purpose AI capability caller, which conflicts with the specialized Seedance skill identity. This kind of misleading packaging is dangerous because reviewers and users may rely on the manifest scope while the code intentionally or accidentally exposes much broader behavior.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill uses extremely broad activation and SEO-style matching terms covering many unrelated products, platforms, and generic video-generation intents. Overbroad routing can cause the skill to trigger in contexts where the user did not intend external uploads, API-backed generation, or credentialed actions, increasing the risk of unintended data handling and confusing tool selection.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The target-user and search-intent sections expand matching to a very large set of companies, marketplaces, advertising products, and generic production goals without clear boundaries. In a skill that can upload user media and store outputs, such broad targeting raises the likelihood of accidental invocation and unintended transmission of sensitive commercial assets to an external service.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation states that user media will be automatically uploaded to an external service and that generated outputs will be automatically downloaded and stored locally, but it does not present a prominent privacy or data-handling warning. This is risky because reference images, videos, and audio may contain sensitive personal, commercial, or copyrighted content, and users may not realize when local or remote persistence occurs.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The API key setup instructions tell users to pass secrets via command line and configuration without a clear warning about shell history, process listings, or accidental disclosure. API keys are high-value credentials; exposing them can let others impersonate the user, consume paid quotas, access account-linked capabilities, or retrieve sensitive task metadata.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.