ClawHub
Back to skill

Security audit

Fantasy Transform Video Gen Seedance2.0

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate WeryAI video-generation helper, but its bundled CLI can perform broader paid API actions than the Seedance-only fantasy workflow it advertises.

Review this before installing if you expect a tightly locked Seedance-only tool. Use it only with non-sensitive prompts and public image URLs, keep WERYAI_API_KEY out of files, verify the confirmation table uses model SEEDANCE_2_0, and expect WeryAI credit consumption for submitted jobs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documentation presents this as a tightly scoped fantasy-video skill, but the described behavior and referenced CLI support broader model selection, registry querying, multiple images, and generic video workflows. That mismatch is dangerous because reviewers and users may approve the skill under false assumptions while the underlying tooling can perform materially different network actions and submit different payloads than advertised.

Ae1

High
Category
analysis-evasion
Content
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares network and environment-variable usage but does not constrain tool scope with explicit permissions or allowed-tools. In an agent ecosystem, this can let the skill invoke broader capabilities than users expect, increasing the chance of unintended outbound requests or secret exposure if the runtime grants default tool access.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The file explicitly states that the skill is 'locked' to `SEEDANCE_2_0` while also admitting the CLI does not enforce that restriction in code. Security and usage restrictions that exist only in documentation are easily bypassed, allowing callers or downstream skills to invoke other models or behaviors with different cost, safety, or data-handling characteristics.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instructions require that every short or vague user brief be turned into a full English production prompt, regardless of the user's preferred language. This is a natural-language locale policy concern because it forces a specific language without offering user choice or documenting a justified regional constraint.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The file names external API hosts and describes sending prompts and public HTTPS image URLs to them, but does not include any explicit warning that user content will be transmitted to a third-party service. In a media-generation skill, prompts and referenced images may contain sensitive or proprietary information, so lack of disclosure increases privacy and compliance risk.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The documentation explicitly states that callers may pass any model and that the script does not enforce the skill’s model restriction from SKILL.md. In a skill advertised as using Seedance 2.0 only, this creates policy bypass and scope expansion: downstream agents or users can invoke other WeryAI models with different capabilities, safety characteristics, or data handling expectations than the skill promises.

Description-Behavior Mismatch

Low
Confidence
80% confidence
Finding
The manifest frames the skill as transforming a short brief or one HTTPS reference image into a specific fantasy-style vertical video. The documented commands expose broader generic generation modes, including unrestricted text-to-video and multi-image submission flows, which exceed the narrowly described skill behavior.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The top-level doc comment presents all user-facing usage instructions, examples, and environment-variable guidance in Chinese only. This creates a language/locale constraint without any opt-in, alternative language, or justification that the tool is region-specific.

Static analysis

No suspicious patterns detected.