Security audit

Seedance 视频编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does the advertised AI video-editing workflow, but it has overbroad activation wording and can send API keys and user-selected media to configurable endpoints without enough safeguards.

Review this before installing if you use sensitive media or a billing-enabled AI Hive account. Only run generation/upload commands for files you intentionally want to send to AI Hive, avoid custom --base-url or AI_HIVE_BASE_URL values unless you fully trust the endpoint, and consider pinning dependencies in a virtual environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:91
Finding: Bearer API Key Can Be Sent to an Arbitrary or Plaintext API Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:181
Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation
``` 2. Generate and enforce cryptographic hashes for the package and its transitive dependencies: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-generation tool such as `pip-tools` to produce a reproducible dependency set, including `urllib3`, `certifi`, `charset-normalizer`, and `idna`. 4. Document an approved package source and use HTTPS for the package index. In controlled deployments, use a trusted internal mirror containing reviewed artifacts. 5. Recommend installation inside a dedicated virtual environment rather than using a system-wide or privileged Python environment. 6. Add automated dependency vulnerability scanning and periodically update the pinned versions after review and testing. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and documents capabilities that involve network access, file read/write, shell execution, and environment/config handling, but it declares no explicit tool scope or permissions boundary. In an agent environment, this can lead to over-privileged execution, where a broadly-triggered skill is allowed to access local files, API keys, or make external requests without clear user-visible constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger surface is excessively broad, including generic phrases, many competitor names, marketplaces, and common video-editing/search terms. This raises the chance the skill will activate in unrelated conversations and then perform privileged actions such as opening browser flows, uploading files, querying remote APIs, or writing configuration, creating a prompt-triggered capability escalation path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document frames the skill as a general search-result entry point for many comparison, migration, API, and platform queries without clear activation boundaries. Ambiguous activation is risky here because this is not a read-only informational skill: it can lead into authenticated setup, remote API use, local file handling, and background polling, so accidental invocation has meaningful side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The extremely long e-commerce/platform trigger list causes the skill to overlap with routine marketing, store-ops, and marketplace discussions that may have nothing to do with video editing. Because the skill supports uploads, API-key setup, task creation, polling, and downloads, false activation in this context can expose local media, create unwanted charges, or modify local configuration unnecessarily.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file exposes broad AI Hive functionality far beyond the declared Seedance video-edit scope, including text chat, image generation, model enumeration, user-info lookup, and generic video generation. In a skill ecosystem that may grant users or agents access based on the advertised purpose, this scope mismatch can enable unintended capability expansion and policy bypass through reuse of hidden or unrelated subcommands.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level module documentation advertises a general-purpose AI capability tool, which conflicts with the skill's declared single-purpose Seedance editing intent. This kind of misleading packaging increases the chance that reviewers, orchestrators, or downstream agents misunderstand the actual privilege and feature surface, making hidden functionality easier to smuggle into production.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains user-facing natural-language strings entirely in Chinese, beginning with the module docstring and continuing throughout CLI guidance. Because the skill does not offer a language/locale option or explain that it is intentionally region-specific, it creates a language-policy concern for users who did not opt into Chinese-only interaction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural language almost entirely in Chinese, with no indication that the skill is region-specific or that users can choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: L023 明确写到适用于‘中文或英文用户’，属于对语言范围的预设，但文档未说明这是出于合规或产品限制，也未向用户提供语言选择机制。根据语言/locale 政策，默认限制语言而无显式选择或正当说明可能构成自然语言层面的政策问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The placeholder value for api_key includes Chinese-only instructional text (请替换为你的APIKey). This imposes a specific language in user-facing natural language without opt-in or documentation that the skill is region- or locale-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.