Security audit

Seedance 短剧生成工作室｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE short-drama media workflow with user-directed uploads, generation calls, and local video helpers; I did not find hidden exfiltration or destructive behavior.

Install this only if you are comfortable sending selected reference images, video, or audio to AI-HIVE and using an AI-HIVE API key for potentially billable generation. Prefer explicit confirmation before generation, use only authorized media, and store the API key via environment variable if you do not want the init command to create a local config file.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises executable capabilities involving environment access, filesystem operations, networking, and shell usage but declares no permissions. This creates a trust and sandboxing gap: operators and users cannot accurately assess what the skill may access, and a permissive runtime could allow unintended data exposure, external calls, or local command execution without explicit review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The documented purpose and the described behavior do not align: the skill claims a focused short-drama production workflow but also exposes broader AI-HIVE chat/model querying and local ffmpeg media manipulation. This mismatch is dangerous because users may authorize the skill under false assumptions, while hidden or underdocumented capabilities can be abused for unintended data processing, external communication, or broader command execution pathways.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill is branded and described as an image-generation workflow, but its exposed CLI still allows generic task inspection and arbitrary media upload. This creates a capability mismatch: a caller expecting a narrowly scoped skill can use it to move unrelated files to a third-party service and inspect backend task data, expanding the attack surface beyond the declared purpose.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file embeds a broad, generic AI Hive client and CLI while the skill metadata presents it as a narrowly scoped Seedance short-drama generation tool. This capability mismatch increases attack surface and can enable unintended account queries, generic chat, or image generation beyond the advertised purpose, violating least-privilege expectations for agent skills.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Exposing a user-info endpoint that returns account profile and wallet balance is broader than necessary for a short-drama video generation skill. If invoked by an agent or user unexpectedly, it can disclose sensitive account metadata and spending information unrelated to the task.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The generic text chat command allows arbitrary model interaction outside the stated Seedance short-drama workflow. In an agent setting, this broadens the skill from a specialized media generator into a general-purpose LLM conduit, creating opportunities for policy bypass, unexpected data transfer, or misuse of the bound API key.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The generic image generation flow is not required for the declared short-drama video-studio scope and permits broader media generation than users or orchestrators may expect. This unnecessary capability expansion increases misuse risk and weakens trust boundaries around what the skill is allowed to do.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill description is broad enough that it can be invoked for a wide range of loosely related requests, increasing the chance of unintended activation and over-delegation. In this context, the skill can trigger workflow generation, API-oriented actions, and production content steps, so unclear boundaries raise the risk of misuse for unauthorized content production or actions the user did not explicitly intend.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt hardcodes Chinese output without user choice, which can override user preference and make the delegated behavior less transparent. While not directly enabling code execution or data exfiltration, it can cause misleading outputs, reduce user comprehension, and hide important workflow or safety details if the user expected another language.

Static analysis

No suspicious patterns detected.