ClawHub
Back to skill

Security audit

Seedance 视频生成

Security checks for vulnerabilities and agentic risk

Overview

This Seedance video skill is mostly purpose-aligned, but it can send a user's AI Hive API key to a user-configured API endpoint without host validation.

Review this skill carefully before installing. Use it only when you intend to submit AI Hive Seedance jobs, upload selected media, and potentially incur charges. Do not set --base-url, AI_HIVE_BASE_URL, or config base_url to any non-AI-Hive endpoint unless you understand that your API key may be sent there; prefer the default AI Hive URL and consider using a limited or revocable API key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/videogen.py:76
Finding

API Credential Disclosure Through an Unrestricted Custom Endpoint

Content
View full analysis

Vulnerability Details

File Location: scripts/videogen.py, lines 76–85 and 134–147
Vulnerability Type: Unrestricted credential forwarding to a user-configurable endpoint
Risk Level: High

Vulnerable Code

python
def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL
python
def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

def _url(self, path):
    return f"{self.base}/openapi/v1/{path}"

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

Technical Analysis

The API base URL can be supplied through the --base-url command-line option, the AI_HIVE_BASE_URL environment variable, or the local configuration file. The application accepts this value without validating its URL scheme or destination host.

AiHiveClient unconditionally attaches the AI Hive API key as a bearer token to requests constructed from that configurable base URL. Consequently, selecting a non-AI-Hive endpoint causes the secret to be transmitted to an arbitrary server. Plain HTTP is also accepted, allowing credentials and request data to be exposed through network interception.

This is an insecure trust-boundary design: a credential scoped for AI Hive is forwarded to a destination that has not been authenticated as AI Hive.

Attack Path

  1. An attacker convinces a user ...[truncated 1340 chars]
Remediation
View remediation

Remediation Suggestions

  1. Restrict normal operation to the fixed, trusted AI Hive HTTPS origin.
  2. Parse the configured URL with a standard URL parser and reject:
    • Plain HTTP.
    • Embedded user information.
    • Unexpected ports.
    • Hosts outside an explicit allowlist.
    • Ambiguous or malformed hostnames.
  3. Never attach the AI Hive bearer token when the destination origin differs from the approved API origin.
  4. If custom endpoints are required for development, gate them behind an explicit development-only option and display a high-friction warning before sending credentials.
  5. Prefer a separate, endpoint-specific credential for development servers rather than forwarding production API keys.
  6. Add automated tests confirming that credentials are not sent to unapproved hosts or across HTTPS-to-HTTP redirects.
  7. Disable redirects for authenticated requests or validate every redirect destination before preserving the Authorization header.

T08 · Insecure Dependencies

Note
Location
SKILL.md:237
Finding

Unpinned Runtime Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 237–241
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

bash
pip3 install requests

Technical Analysis

The installation instructions direct users to install requests without specifying a reviewed version or cryptographic package hash. Package resolution therefore depends on the package index state at installation time and may retrieve a release that did not exist when the Skill was audited.

This prevents reproducible installation and weakens supply-chain controls. It also leaves transitive dependency versions unconstrained. Although the package name is legitimate and no malicious package is embedded in the project, the instructions do not protect users against a future compromised release, dependency compromise, or an unsafe package index configuration.

Attack Path

  1. A user follows the documented installation command.
  2. pip contacts its configured package index and resolves the latest compatible requests release and dependencies.
  3. If the selected package source or a future resolved release is compromised, malicious package content is downloaded.
  4. Malicious installation or runtime code executes with the privileges of the user running pip or the Skill.
  5. The code could access the Skill's API key, uploaded media, generated output, and other files available to that user.

Exploitation depends on compromise or manipulation of the dependency source or resolved package versions; no such compromise is present in the audited repository itself.

Impact Assessment

The maximum privilege available to a malicious dependency is generally that of the account performing the installation or running the script. Potential scope includes:

  • Reading the AI Hive API key from environment variables or ~/.ai-hive/config.json.
  • Reading user-selected media and generated output.
  • Modifying file ...[truncated 343 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a dependency manifest that pins reviewed versions of requests and all transitive dependencies.
  2. Include cryptographic hashes and install with pip --require-hashes.
  3. Generate and maintain a lock file using a dependency-locking tool appropriate for the supported Python versions.
  4. Document installation from the locked dependency file instead of using pip3 install requests.
  5. Use an isolated virtual environment rather than installing into a global Python environment.
  6. Periodically scan pinned dependencies for known vulnerabilities and update them through a reviewed process.
  7. Configure package installation to use a trusted HTTPS index and avoid untrusted additional indexes.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing natural language exclusively in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents capabilities that imply access to environment variables, local files, network, and shell execution, but it does not declare any explicit tool scope or permission boundaries. In an agent runtime, this creates ambiguity about what the skill may invoke and increases the chance of overprivileged execution, unintended file access, or external network actions such as uploading user media or writing API keys without clear consent boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level description contains extremely broad activation terms spanning generic AI video, ads, social media, e-commerce, competitor products, APIs, pricing, and workflow migration. Overbroad triggers can cause the agent to invoke this skill for loosely related requests, leading to unnecessary exposure of shell/network/file capabilities and increasing the chance that users are funneled into a more privileged workflow than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The applicable-user section defines the target audience and matching phrases so broadly that almost any user asking about video generation, ads, e-commerce, or related brands could match. In context, this is more dangerous because the skill also supports networked uploads, task submission, downloads, and API-key setup, so accidental activation may trigger privileged or cost-incurring operations for users who only wanted comparison or general advice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The example API key placeholder uses Chinese text ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. There is no indication that the skill offers a language choice or that the locale constraint is intentional and documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code presents its top-level description entirely in Chinese and later exposes CLI help, prompts, and status messages only in Chinese. Because the file does not offer a user language or locale choice, it creates a natural-language policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.