Security audit

Epic Cinematic Transform Video Gen Seedance2.0

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about using WeryAI for paid video generation, but its bundled CLI can perform broader paid API actions than the skill advertises.

Review this skill before installing if you care about cost controls or strict model limits. It needs a WeryAI API key and sends prompts and public image URLs to WeryAI. The main risk is not hidden malware; it is that the included CLI is a general WeryAI video tool, so a mistaken or manipulated call could spend credits on models or modes outside the advertised Seedance 2.0-only workflow unless the agent carefully follows the confirmation and validation instructions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video_gen.js:161
Finding: Declared Model and Generation-Mode Restrictions Are Not Enforced by the CLI
Content: View full analysis
0) return 'multi_image'; if (typeof params.image === 'string' && params.image) return 'image'; return 'text'; } function coerceBool(v, defaultVal = false) { if (v == null) return defaultVal; if (typeof v === 'boolean') return v; return String(v).toLowerCase() === 'true'; } function hasNonEmptyModel(params) { const m = params.model; return m != null && String(m).trim() !== ''; } function buildRequestBody(params) { const model = String(params.model).trim(); const body = { prompt: params.prompt, model, duration: Number(params.duration) || 5, }; if (params.aspect_ratio) body.aspect_ratio = params.aspect_ratio; if (params.resolution) body.resolution = params.resolution; if (params.generate_audio != null) body.generate_audio = coerceBool(params.generate_audio, false); if (params.negative_prompt) body.negative_prompt = params.negative_prompt; if (params.image) body.image = params.image; if (params.images) body.images = params.images.slice(0, 3); return body; } async function submitTask(params, apiKey) { if (!hasNonEmptyModel(params)) { return { ok: false, phase: 'failed', errorCode: 'MISSING_PARAM', errorMessage: "'model' is requ ...[truncated 3812 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims to be locked to SEEDANCE_2_0, but the file itself admits the underlying video_gen.js does not enforce that restriction in code and can list models from a general registry endpoint. That mismatch is dangerous because an agent may trust the description while actually invoking broader video-generation and model-selection behavior, leading to unexpected external API usage, policy bypass, or higher-cost actions outside the advertised scope.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares access to secrets and network use in metadata, but it does not define an explicit tool/permission scope limiting what may be invoked. In an agent environment, this increases the chance that the skill can access environment variables and make outbound requests more broadly than users expect, reducing least-privilege protections and making accidental secret exposure or unintended network use more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions explicitly say to turn the user's brief into a full English production prompt before submission. This imposes a language choice by default and does not offer the user a language preference or opt-in, which is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The implicit trigger prompt is broad enough that ordinary user requests for cinematic or trailer-style video effects may activate the skill without an explicit invocation. This can cause unintended skill routing, increasing the chance that the agent applies this skill in contexts the user did not clearly request, which is a prompt-routing and authorization boundary issue rather than direct code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs users to send prompts and image URLs to WeryAI using an API key, but it does not clearly warn that user-supplied content will be transmitted to a third-party service. In a skill that may process user creative inputs or linked media, this can lead to unintended disclosure of sensitive prompts, personal images, or proprietary content if operators assume processing is local or first-party.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.