Security audit

Seedance 图生视频

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for AI video generation, but it sends user media and API credentials through under-scoped network behavior that users should review before installing.

Install only if you are comfortable sending selected media to AI Hive and storing an API key locally. Use the default AI Hive endpoint, avoid setting custom base URLs from untrusted instructions, do not upload sensitive or regulated images without approval, and consider installing dependencies in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:91
Finding: Bearer API Key Can Be Transmitted to an Arbitrary Configured Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:176
Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The changelog content is predominantly written in Chinese, which indicates the skill documentation is oriented to a specific language without any visible language-choice, opt-in, or justification in this file. Under the policy rule for natural-language violations, forcing a specific language can be a locale policy issue when no alternative or rationale is provided.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and documents capabilities that imply shell, network, file read/write, and environment access, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance of over-privileged execution, making unintended file access, credential exposure, or outbound requests more likely if the skill is invoked in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description includes a very large set of competitor names, platforms, and shopping/search phrases far beyond the narrow image-to-video function. This can cause the skill to activate for loosely related user queries, leading an agent to run upload/network-capable automation in contexts where the user only wanted comparison information, increasing the risk of unintended data handling or surprising actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly states that it will automatically upload local media to an external service and later download generated videos, but it does not prominently warn about privacy, retention, third-party processing, or accidental transmission of sensitive files. Because the skill is designed around local asset handling, this omission materially increases the risk of users exposing confidential images, videos, or audio without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README expands activation to broad platform, merchant, advertising, and workflow-migration searches without clear execution boundaries. In context, this is more dangerous because the skill also supports automatic media upload, task submission, polling, and downloads, so over-triggering could escalate a casual discovery query into external processing of user assets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file-level docstring and earlier CLI structure present this script as a '通用 AI 能力调用工具' supporting chat, image generation, video generation, model queries, media upload, and task polling. However, the actual entrypoint at L940 calls skill_main, whose parser only exposes generate, task, upload, and init, and generate is fixed by SKILL_CONFIG to the Seedance i2v workflow. This is a semantic mismatch between the code documentation and what the shipped skill actually does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file contains user-facing natural-language strings entirely in Chinese, beginning with the module description and continuing throughout prompts and CLI help. The skill does not offer any language or locale selection or indicate that Chinese is a justified region-specific requirement, which can violate language-choice policy.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: SKILL_CONFIG states the skill is for '固定调用 Seedance 的图生视频裸接口能力', which implies a narrowly scoped image-to-video generation function. Yet the skill parser also exposes separate task and upload commands at L912-L917, allowing users to query arbitrary generation tasks and upload media independently of immediate Seedance generation. That broadens the operational surface beyond the stated fixed generate-only capability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.