Security audit

Seedance + Waoo 短视频流水线

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent video-generation workflow, but it handles API keys and private media with under-scoped endpoint and download controls.

Review before installing. Use only trusted, official provider endpoints or explicitly trusted gateways, keep API keys out of chat and shared logs, expect configured prompts/images/audio/video to leave your machine, and avoid direct-run modes unless you are ready to spend provider quota. Rotate any key that may have been used with an untrusted config endpoint.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run-seedance-workflow.cjs:286
Finding: Weak Endpoint Validation Can Disclose API Credentials and Local Media
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download-official-video.cjs:45
Finding: Unrestricted Video URL Download Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (87)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This second mismatch finding is more specific: the skill claims support for Seedance, Vidu, and MiniMax plus ASR/TTS/merge delivery, but the analyzed implementation reportedly only supports a subset and omits several claimed features. In a workflow skill, inaccurate capability claims are dangerous because downstream users may expose credentials, trigger network actions, or rely on absent post-processing/validation stages under false assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This second mismatch finding is more specific: the skill claims support for Seedance, Vidu, and MiniMax plus ASR/TTS/merge delivery, but the analyzed implementation reportedly only supports a subset and omits several claimed features. In a workflow skill, inaccurate capability claims are dangerous because downstream users may expose credentials, trigger network actions, or rely on absent post-processing/validation stages under false assumptions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
md
When scheduling with `scripts/run-seedance-workflow.cjs`, continue actions must map to stage-specific approvals:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 438)May include surrounding context.
md
- `scripts/submit-official-video.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 440)May include surrounding context.
md
- `scripts/poll-official-video.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 441)May include surrounding context.
md
- `scripts/download-official-video.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 442)May include surrounding context.
md
- `scripts/generate-tts.ts` (TTS 选择后子脚本级配置检查，缺失返回结构化 `configuration-guidance`)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 447)May include surrounding context.
md
- `scripts/self-test-workflow-driver.cjs` (用于校验 workflow driver 的阶段/审批映射)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 448)May include surrounding context.
md
- `scripts/run-video-submit-chain.cjs` (首图确认后统一调度提交/轮询/下载)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.
md
- `scripts/build-dispatch-plan.cjs` (只产出调度指令与检查点，不执行)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/audio-policy.md (reported line 39)May include surrounding context.
md
Rules: - spoken text must be intentional, not accidental - if the video prompt implies mouth movement, ensure the audio plan is explicitly decided - do not leave a “mouth moving but no speech” mismatch without warning ## Ambience acceptance rules

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/clip-state-contract.md (reported line 5)May include surrounding context.
md
## Purpose Every clip should have a clear state label so the pipeline never confuses candidate outputs with deliverables. ## Recommended states

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill describes workflow execution that relies on environment variables and networked vendor/API access, but it does not declare any explicit tool scope or permissions boundary. That makes invocation and review less predictable, increases the chance of over-broad runtime capability use, and weakens least-privilege controls around API keys and outbound requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The auto-trigger rules are broad enough to match many ordinary creative-writing or ideation requests, causing the skill to activate when the user may not intend a networked or stateful production workflow. Unintended invocation can lead to unnecessary external calls, premature workflow state changes, or collection/use of configuration secrets in contexts where a simple text response would have been safer.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This example config uses Chinese field names throughout, such as "厂商", "接口地址", and "模型名", with no indication that other languages are supported. That can violate a language/locale policy when a skill implicitly requires one language without explicit user opt-in or documented justification.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · config/pipeline.config.example.json (reported line 5)May include surrounding context.
json
"upstream": { "seedance": { "厂商": "MiniMax", "接口地址": "https://api.minimaxi.com/v1", "模型名": "your-upstream-model", "APIKey": "your-upstream-key" }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · config/pipeline.config.example.json (reported line 14)May include surrounding context.
json
"upstream": { "seedance": { "厂商": "MiniMax", "接口地址": "https://api.minimaxi.com/v1", "模型名": "your-upstream-model", "APIKey": "your-upstream-key" }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · config/pipeline.config.example.json (reported line 20)May include surrounding context.
json
"upstream": { "seedance": { "厂商": "MiniMax", "接口地址": "https://api.minimaxi.com/v1", "模型名": "your-upstream-model", "APIKey": "your-upstream-key" }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · config/pipeline.config.example.json (reported line 26)May include surrounding context.
json
"upstream": { "seedance": { "厂商": "MiniMax", "接口地址": "https://api.minimaxi.com/v1", "模型名": "your-upstream-model", "APIKey": "your-upstream-key" }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/configuration-template.md (reported line 40)May include surrounding context.
md
"upstream": { "seedance": { "厂商": "MiniMax", "接口地址": "https://api.minimaxi.com/v1", "模型名": "your-upstream-model", "APIKey": "your-upstream-key" }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/configuration-template.md (reported line 64)May include surrounding context.
md
"upstream": { "seedance": { "厂商": "MiniMax", "接口地址": "https://api.minimaxi.com/v1", "模型名": "your-upstream-model", "APIKey": "your-upstream-key" }

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document instructs users to use specific Chinese labels for user-facing setup guidance, which effectively forces a locale/language choice. This is a natural-language policy concern because no opt-in, alternative language option, or region-specific justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance explicitly tells the operator to provide API keys, tokens, app IDs, and endpoint details, but it does not warn against placing secrets in prompts, logs, screenshots, shared config, or other insecure channels. In a first-run setup guide, this omission can lead users to expose credentials during onboarding, especially because the file frames credential collection as normal configuration rather than sensitive handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This documentation includes commands that can trigger real third-party video generation, polling, downloads, and image uploads, which may incur cost and transmit user media or prompts off-machine, but it does not clearly warn the operator before those steps. In this skill context, the risk is elevated because the file is an execution-policy note for an automation pipeline, so readers may treat the commands as safe defaults and run them without realizing the financial and privacy consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented direct-start behavior states that a start action may immediately call downstream production when config is ready, yet it does not present a prominent warning that this can launch external jobs, upload assets, and consume paid quota. Because this is framed as first-run onboarding behavior, it is especially dangerous: a new operator on a fresh machine may expect diagnostics or dry-run behavior and instead trigger real external actions.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/_shared.ts:294

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/continue-after-first-image.cjs:41

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/continue-seedance-flow.cjs:114

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/diagnose-environment.cjs:37

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/merge-final-videos.ts:73

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/mix-final-video.ts:33

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/run-seedance-entry.cjs:145

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/run-seedance-workflow.cjs:40

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/run-video-submit-chain.cjs:74

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/self-test-prompt-pack.cjs:17

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/self-test-workflow-driver.cjs:39

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/_shared.ts:307