Security audit

Seedance 参考视频生视频

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do the advertised AI video workflow, but its activation scope is much broader than that workflow while it uploads user media and stores an API key.

Install only if you intend to use AI Hive for Seedance reference-video generation. Use it only with files you are comfortable uploading to AI Hive/object storage, monitor costs before batch jobs, and avoid letting broad comparison or marketplace-search prompts trigger generation unless you explicitly choose the media and task.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation describes capabilities that read environment variables, write local config files, access the network, and invoke shell/Python commands, yet no explicit permissions are declared. This creates a transparency and consent problem: users and hosting platforms may not realize the skill can exfiltrate API keys, upload local media, or persist credentials locally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented behavior extends beyond the stated Seedance reference-video workflow into broader account, model-listing, generic upload/task operations, and interactive credential setup. That mismatch is dangerous because it increases the reachable attack surface and may let the skill perform sensitive actions users would not reasonably expect from a narrowly described video-generation tool.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file exposes a full generic AI Hive client and multiple command families, while the declared skill is supposed to be narrowly scoped to Seedance reference-to-video. This scope mismatch increases attack surface and enables capabilities a caller may not expect, violating least-privilege and making misuse easier if the skill is invoked in a broader automation context.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill includes a user-info endpoint that can retrieve account information and wallet balance, which is unrelated to generating reference-to-video outputs. In an agent setting, exposing unnecessary account metadata increases privacy and reconnaissance risk and gives downstream workflows access to information they do not need.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The presence of text chat and image generation operations expands the skill beyond its stated purpose and allows invocation of unrelated paid or data-processing features. In a constrained agent environment, such hidden extra capabilities can be abused for unauthorized model usage, data exfiltration through prompts/media, or billing abuse.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module presents itself as a generic AI capability tool rather than a fixed Seedance reference-to-video skill, signaling that the implementation and the declared trust boundary do not align. This kind of capability ambiguity is dangerous because reviewers and orchestrators may grant it permissions based on the narrow manifest while the code supports much broader actions.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation text is extremely broad, covering many unrelated product comparisons, migrations, marketplaces, and generic video-tool searches. Overbroad triggers can cause the skill to activate in contexts where users did not intend remote uploads, credential setup, or automated downloads, increasing the chance of inappropriate tool use and unintended data disclosure.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The audience and trigger scope rely on expansive keyword matching with little constraint, which can lead to accidental invocation for loosely related queries. In this skill’s context, accidental activation is more dangerous because the documented workflow includes uploading user media to a third-party service and persisting credentials locally.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The upfront description does not clearly warn users that local media will be uploaded to a remote service and that outputs will be downloaded automatically. This omission undermines informed consent and can expose sensitive video/audio/image content or metadata to third-party infrastructure without users appreciating the data transfer implications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.