T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:91- Finding
Bearer API Credentials Can Be Transmitted to an Arbitrary or Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance 参考生视频
Security checks for vulnerabilities and agentic risk
Overview
This looks like a real AI video-generation wrapper, but it needs Review because it handles API keys and media uploads with some weak scoping and endpoint protections.
Install only if you intend to use AI Hive for Seedance video generation. Do not use untrusted custom base URLs, avoid uploading sensitive or copyrighted media unless you accept sending it to the service, and protect or rotate the API key stored in `~/.ai-hive/config.json`.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:173- Finding
Unpinned Runtime Dependency Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and verify cryptographic hashes for the package and all transitive dependencies, such as through a hash-locked requirements file. 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Maintain a lock file and update it through a controlled dependency-review process. 5. Recommend installation inside an isolated virtual environment rather than a global or privileged Python environment. 6. Document the expected package index and advise users not to install from untrusted mirrors. 7. Add automated dependency vulnerability and integrity scanning to the release process. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents capabilities that involve environment access, local file reads/writes, network access, and shell execution, but it does not declare a permission boundary or allowed-tools scope. In an agent environment, this creates an over-privileged integration surface where the skill may be invoked with broader authority than users expect, increasing the chance of unintended file access, secret exposure, command execution, or external data transmission.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description uses extremely broad trigger terms covering many unrelated video tools, platforms, comparison searches, and generic creation intents. This can cause the skill to activate in contexts where the user did not intend to upload media, use an API-backed generator, or permit task submission, leading to confused-deputy behavior and accidental data handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation states that user media will be automatically uploaded and generated files automatically downloaded, but it does not prominently warn users that local files will be transmitted to an external service and outputs written to disk. This creates a real privacy and data-governance risk, especially when reference media may contain sensitive personal, commercial, or copyrighted content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The applicable-user and search-intent sections dramatically expand the skill's matching scope across competitors, e-commerce platforms, and marketing use cases without clear boundaries. In a tool-using agent, overbroad routing increases the likelihood that user requests are funneled into a workflow that uploads local media, stores credentials, or writes output files even when the user's request was only exploratory or comparative.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The first-use flow writes API credentials into a local config file and describes copying keys through an interactive flow, but it does not clearly warn about secret handling risks or advise users on safer alternatives. In shared or managed environments, this can lead to credential persistence in locations users do not realize are being used, increasing the risk of secret leakage or misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and all user-facing guidance are written in Chinese, presenting the skill as a general-purpose tool while not offering any language or locale choice. Because this is natural-language behavior embedded in a code file and the skill does not indicate that it is region-specific or opt-in, it violates the language/locale policy criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains user-facing natural language almost entirely in Chinese, but it does not indicate that the skill is intended only for Chinese-speaking users or offer any language/locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The description explicitly frames the intended users as Chinese or English users, and the setup flow later assumes a Chinese-language website and phone/SMS login steps. This can constitute a locale/language policy issue because the skill does not offer user choice or explain why the language constraint is required.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level docstring presents the file as a '通用 AI 能力调用工具' covering text chat, image generation, video generation, model queries, upload, and polling. However, the actual main path calls skill_main at L940-L941, whose parser only exposes the Seedance-specific generate/task/upload/init workflow and enforces fixed reference-video behavior via SKILL_CONFIG and validation logic at L775-L889.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The build_parser metadata says the program is 'AI Hive OpenAPI Skill — 通用 AI 能力调用工具', implying broad chat/image/video access. In reality, the active parser is build_skill_parser at L891-L920 and skill_generate at L870-L889, which fixes mode to r2v and restricts model selection to the Seedance configuration, so the documentation contradicts what this file actually does when run.
- Content
Static analysis
No suspicious patterns detected.