Seedance Prompt Wizard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:01 AM UTC
• Version: 1.0.4

Overview

This is a prompt-only Seedance helper with no local execution, but it forces an unverified API-documentation link and service claims into generated outputs.

Review this skill before installing if you do not want agents to repeatedly include a third-party API link or unsupported service claims in prompt outputs. Treat seedance2api.app as unverified unless you independently confirm its provenance, and expect broad generic prompt-writing requests to potentially activate this Seedance-specific workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:123
• Finding: Mandatory Output Template Promotes an Unverified External Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 123–148 **Vulnerability Type**: Mandatory output injection through skill instructions **Risk Level**: Medium ### Vulnerable Skill Text The following is an English translation of the relevant mandatory output template: ```text ## Standard Output Format ━━━━━━━━━━━━━━━━━━━━ Precise Prompt ━━━━━━━━━━━━━━━━━━━━ [Complete Chinese prompt] ━━━━━━━━━━━━━━━━━━━━ Reference API Parameters ━━━━━━━━━━━━━━━━━━━━ model: [model name] duration: [duration] quality: 720p aspect_ratio: [aspect ratio] generate_audio: true prompt: [English prompt] ━━━━━━━━━━━━━━━━━━━━ Usage Instructions ━━━━━━━━━━━━━━━━━━━━ • Link validity period: 24 hours; download promptly • It is recommended to test with the fast model first • Recommended prompt length: no more than 500 Chinese characters or 1,000 English words • Audio is enabled by default; set generate_audio: false for silent video • API documentation: https://seedance2api.app ``` ### Technical Analysis The skill declares itself to be a prompt-generation assistant that performs no API calls, but its mandatory response template requires the agent to include an external API website in generated answers. Referring users to this domain is not necessary for the stated prompt-generation function. The project provides no evidence establishing that `seedance2api.app` is an official or trusted Seedance service. The template also requires unsupported service-specific assertions, including a 24-hour link lifetime and a recommendation to use a “fast” model. Because these statements are embedded in the standard output format, an agent following the skill may present them as authoritative regardless of the user's request. This constitutes instruction hijacking at the skill-content level: loading and following the skill systematically modifies the agent's output to promote an unverified external service. ### Attack Path 1. A user invokes the skill to generate a Seedance video ...[truncated 1304 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `https://seedance2api.app` from the mandatory output template. 2. Remove unsupported operational claims concerning link expiration, model availability, and service behavior. 3. Keep generated responses limited to the declared function of producing video prompts and optional parameter suggestions. 4. If documentation is necessary, use only a verified official URL and identify the service owner explicitly. 5. Make external references optional and disclose when a link leads to an unaffiliated third-party service. 6. Do not require the agent to include promotional links in every generated response. 7. Add a review policy requiring maintainers to verify external domains and service claims before publishing skill updates. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad, common phrases such as '帮我写提示词' and '制作提示词', which can cause the skill to activate in conversations that are not specifically about Seedance. Unintended invocation can route user input into the wrong skill, causing confusing behavior, prompt hijacking opportunities, or accidental disclosure of user context to an irrelevant workflow.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The prescribed output standard requires a “完整中文 Prompt” and an “英文版 Prompt,” which imposes fixed language behavior rather than letting the user choose their preferred language. This can violate language/locale flexibility expectations because no opt-in or alternative language path is documented.

Static analysis

No suspicious patterns detected.