T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:395- Finding
Path Traversal Through Untrusted Task Metadata During Result Download
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedance 文生视频
Security checks for vulnerabilities and agentic risk
Overview
This looks like a real AI Hive video-generation skill, but it needs review because its activation scope is very broad and its downloader can write files outside the chosen output folder if the API response is malicious.
Install only if you intend to use AI Hive for Seedance video generation and are comfortable storing an AI Hive API key locally. Avoid custom or untrusted --base-url values, choose an output directory that does not contain important files, and review task costs before running broad or batch generation requests.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:166- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill describes capabilities that involve environment access, file reads/writes, network use, and shell execution, but it does not declare any explicit tool scope or permission boundaries. That makes the runtime authority implicit and increases the chance the agent invokes powerful actions without clear least-privilege constraints or informed approval.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation description is extremely broad, covering generic video generation, competitor comparisons, pricing, APIs, domestic availability, workflow migration, and many e-commerce use cases. Overbroad matching can cause the skill to trigger in unrelated contexts and then gain access to network, shell, and file operations for requests the user did not specifically intend this skill to handle.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The applicable-user section uses an expansive keyword list with little boundary definition, making accidental or opportunistic activation more likely. In a skill that can access credentials and perform networked task submission, unnecessary activation broadens the attack surface and can lead to unexpected external API calls or data handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The competitor and migration section enumerates many brands and generic comparison intents, effectively turning this into a catch-all trigger for a large part of the AI video ecosystem. Because the skill can submit tasks, store identifiers, and download outputs, misactivation could cause unintended external actions under the guise of a loosely related comparison request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The e-commerce platform section makes the skill eligible for a huge range of merchant, platform, advertising, and asset-production queries that extend far beyond the core Seedance text-to-video function. In context, this is more dangerous because the skill also handles API keys, file writes, uploads, polling, and downloads, so broad discovery increases the chance of unintended execution with powerful capabilities.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file contains a full generic AI Hive client with chat, image, model enumeration, upload, and task features, while the manifested skill is supposed to be narrowly scoped to Seedance text-to-video. Although the final entrypoint uses the restricted skill parser, shipping broader capability code in the same file increases the risk of accidental exposure, future wiring mistakes, or repurposing by an agent/runtime that invokes the wrong entrypoint or imports the helper functions directly.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level docstring describes the script as a 'general AI capability invocation tool' supporting chat, image, video, model query, upload, and polling, which conflicts with the declared fixed-purpose Seedance text-to-video skill. This mismatch is dangerous because operators, wrappers, or automated tooling may trust the documentation and expose broader actions than intended, undermining least-privilege assumptions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file-level docstring presents the skill entirely in Chinese as a general-purpose tool, and the user-facing prompts and help text throughout the script are also Chinese-only. For a general skill, this creates a language policy issue because it enforces a specific language without any user opt-in or documented locale restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing natural language almost entirely in Chinese, including all substantive changelog entries. Under the language/locale policy rule, forcing a specific language without user opt-in or a documented justification is a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example API key value contains Chinese-only instructional text ('请替换为你的APIKey'). This imposes a specific language in user-facing configuration content without any indication of language choice or locale-specific scope, which conflicts with the language/locale policy criteria.
- Content
Static analysis
No suspicious patterns detected.