ClawHub
Back to skill

Security audit

Seedance 2.0 — AI Video by ByteDance

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real video-generation helper, but its included script can do more with Atlas Cloud than the Seedance-only documentation clearly discloses.

Install only if you are comfortable giving the skill an Atlas Cloud API key and sending prompts, image URLs, and potentially uploaded local media to Atlas Cloud. Review commands before running them, especially model IDs, upload actions, and uses of --yes, because the bundled script is broader than the Seedance-focused description.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The documented purpose is narrowly framed as Seedance 1.5 Pro generation, but the finding indicates the underlying behavior can access broader Atlas Cloud video functionality, including undeclared model selection and additional input modes. This mismatch is dangerous because users and policy systems may authorize the skill based on a limited description while the implementation can transmit more data types or perform more actions than disclosed.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill requires environment access to an API key and performs outbound network requests, but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens policy enforcement and reviewability, making it easier for a caller or runtime to grant broader capabilities than users expect when the skill is invoked.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The activation text is extremely broad, covering generic video, marketing, social, animation, and product-demo requests. Over-broad triggering increases the chance the skill is invoked in contexts where users did not intend third-party transmission of prompts, image URLs, or generated media, causing consent and data-handling risks.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest describes a skill for generating videos specifically with ByteDance's Seedance 1.5 Pro, emphasizing text-to-video and image-to-video. However, the file docstring and CLI examples show a provider-agnostic Atlas Cloud client using arbitrary model IDs such as alibaba/wan-2.6 and explicitly supporting video-to-video and generic model listing, which materially exceeds and diverges from the claimed Seedance-specific behavior.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest claims support for text-to-video and image-to-video with synchronized audio generation, but does not state support for transforming existing videos or accepting standalone audio-guided inputs. The code exposes both --video/--videos and --audio parameters and forwards them to the generation API, adding substantive capabilities beyond the declared description.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The top-level docstring enumerates the supported generation modes and omits audio-guided generation, implying a closed set of capabilities. Later, the CLI defines an --audio option and includes it in submitted parameters, so the documentation understates what the code actually supports.

Static analysis

No suspicious patterns detected.