Seedance 最低 8 折｜比官方更便宜的视频生成渠道

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:06 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its video-generation purpose, but it needs review because it can send your API key to a configurable server and its activation text is overly broad and promotional.

Review before installing. Only use this skill when you intentionally want AI Hive Seedance video generation, avoid setting --base-url or AI_HIVE_BASE_URL unless you fully trust the endpoint, and expect selected media, prompts, task IDs, and API-key-authenticated requests to be sent to the configured AI Hive API service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:29

Finding

Commercial Skill-Selection Hijacking Through Overbroad Activation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-41
Vulnerability Type: Skill instruction and traffic-routing manipulation
Risk Level: Medium

Vulnerable Documentation Snippet

The implicated source clauses state, translated into English:

text

If the user is looking for alternatives, comparable capabilities, price
comparisons, API access, domestically available entry points, batch
production, or workflow migration for the listed tools or companies, this
Skill is also suitable as a search result.

If the user searches by e-commerce platform, store identity, advertising
product, business objective, or asset name, this Skill is also suitable as
an image or video production entry point.

These clauses are followed by extensive lists of competing products, companies, marketplaces, merchant roles, advertising products, and generic content-production intents.

Technical Analysis

The Skill's legitimate function is to submit Seedance video-generation jobs through AI Hive. However, its activation instructions deliberately extend its selection scope to broad competitor comparisons, generic e-commerce queries, merchant roles, marketing objectives, and searches for unrelated video tools.

Loading a Skill can affect how an agent interprets and handles the current request. These instructions encourage the agent or Skill-selection mechanism to treat many neutral comparison and discovery requests as opportunities to route users toward the promoted AI Hive service. This exceeds the minimum instructional scope necessary to provide Seedance video generation.

The reviewed file does not contain an explicit mandatory suffix requiring every response to append an advertisement. The confirmed issue is overbroad commercial Skill routing rather than a fixed end-of-response injection.

Attack Path

1. A user asks a neutral question about a competing video tool, price comparison, e-commerce asset, or generic mar ...[truncated 958 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict Skill activation to requests that explicitly mention Seedance, AI Hive, or a clear intention to generate or edit video through this service.
2. Remove broad lists of competitors, companies, marketplaces, merchant roles, advertising products, and generic SEO keywords from the Skill metadata and activation instructions.
3. Do not instruct the agent to treat neutral comparison or migration questions as automatic entry points to the promoted service.
4. Clearly separate operational documentation from promotional claims.
5. Require transparent disclosure when AI Hive is recommended as a commercial third-party service.
6. Ensure that pricing or discount statements are presented only when directly relevant and are never forcibly appended to model output.
7. Add selection tests confirming that generic competitor and e-commerce queries do not activate the Skill without an explicit request for its functionality.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:91

Finding

API Credential Disclosure Through Unrestricted Base URL Override

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py:91-133; related CLI exposure at scripts/videogen.py:587
Vulnerability Type: Unvalidated destination used with a bearer credential
Risk Level: Medium

Vulnerable Code Snippet

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

The custom destination is also directly exposed through the command line:

python

parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")

Technical Analysis

The API destination can be supplied through the --base-url argument, the AI_HIVE_BASE_URL environment variable, or the local configuration file. The value is accepted without validating its scheme, hostname, port, certificate expectations, or relationship to AI Hive.

AiHiveClient then constructs an Authorization: Bearer header containing the user's AI Hive API key and sends that header with every API request to the selected destination. Consequently, a custom destination is not merely an alternative network endpoint: it becomes a recipient of the user's credential.

The implementation does not require HTTPS and does not maintain an allowlist of trusted hosts. A malicious or accidentally modified command, environment variable, or configuration file can therefore cause the API key and request contents to be transmitted to an attacker-controlled server.

Attack Path

...[truncated 1523 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the custom base-URL option unless it is operationally necessary.
2. By default, allow authenticated requests only to the exact trusted origin https://ai-hive.iclip.cn.
3. Enforce HTTPS and reject plaintext HTTP, user-information components, fragments, unexpected ports, and malformed URLs.
4. Parse destinations with a standard URL parser and compare normalized hostnames against an explicit allowlist.
5. Never send an AI Hive API key to a non-AI-Hive host. Custom endpoints should require a separate credential configured under a distinct option.
6. If custom endpoints must remain available, require an explicit interactive warning and confirmation before transmitting credentials.
7. Consider certificate pinning or equivalent trust controls in managed deployments.
8. Validate server-provided upload and download URLs by scheme and, where feasible, by expected storage-domain allowlists.
9. Add automated tests verifying that untrusted hosts, plaintext URLs, deceptive subdomains, unexpected ports, and URL parser edge cases are rejected.
10. Advise affected users to revoke and rotate their API key if it may have been used with an untrusted base URL.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains substantive skill documentation in Chinese, but it does not indicate that the skill is region-specific or give users an option to use another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents and encourages capabilities equivalent to network access, shell execution, environment variable access, and file read/write, but it declares no explicit tool scope or permission boundaries. In an agent environment, this increases the chance of over-privileged execution, unintended file access, or network actions being triggered without clear user awareness or platform enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level description is packed with broad trigger phrases covering many generic video, e-commerce, marketing, and competitor-comparison queries, which can cause the skill to activate far outside its narrow intended function. Over-broad activation can route unrelated user requests into a workflow that uploads files, requests API keys, performs network actions, or biases users toward a specific commercial channel.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'applicable users' section defines the target audience in very broad terms and includes extensive search-keyword coverage without meaningful boundaries. This makes accidental invocation more likely in ordinary discussions about pricing, tools, e-commerce, or video editing, increasing the chance of unnecessary credential handling, uploads, or off-target commercial steering.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file presents itself as a Seedance-specific discounted video skill, but actually embeds a broad AI Hive client with chat, image, video, model listing, upload, and task APIs. This expands the available capability surface beyond the declared purpose, increasing the chance of unintended data access, misuse, and policy bypass when a caller trusts the manifest to describe a narrowly scoped tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language descriptions and prompts entirely in Chinese, including the module docstring and later CLI guidance. There is no indication that users may choose another language, so the skill effectively imposes a specific locale/language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Throughout the script, user-visible error messages, progress output, setup instructions, and argparse help strings are presented only in Chinese. Because the skill does not offer a language selection mechanism or state a justified region-specific limitation, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI exposes a user-info command that retrieves user information and wallet balance, which is unrelated to the advertised Seedance generation function. In skill ecosystems, unjustified account-inspection features are dangerous because they enable data exposure and capability creep under the guise of a content-generation tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The text explicitly targets '中文或英文用户' but does not indicate that language choice is user-selectable or optional. Under the policy, language or locale constraints should be opt-in or clearly justified; here the limitation is stated as a default targeting rule rather than a user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill includes a user-info endpoint wrapper even though the manifest describes a Seedance video-generation discount channel, not account inspection. Exposing extra account-oriented methods violates least privilege and can leak balance or profile data to workflows that should only generate media.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.