Security audit

Seedance Video Gen 1 2.0

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid WeryAI video-generation helper that uses one API key and fixed HTTPS endpoints, with no evidence of hidden persistence, local data harvesting, or destructive behavior.

Install only if you trust WeryAI with your API key, prompts, and public media URLs, and expect paid generation charges. Review the confirmation table before each run because the script will submit exactly the model and fields the agent passes to it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill documentation claims strict Seedance-specific defaults and safety constraints, but the implementation reportedly does not enforce them and may behave as a generic video-generation wrapper. This mismatch is dangerous because agents and users may trust the documented guardrails, while actual execution can send unsupported or unintended parameters, hit unexpected models, or incur paid network actions under false assumptions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares runtime requirements indicating access to environment secrets and outbound network use, but it does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may invoke code with broader capabilities than a reviewer or user expects, increasing the risk of secret exposure or unbounded external requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction says to turn every short brief into a full English production prompt, which imposes a specific language choice regardless of the user's preferred language. This is a natural-language policy concern because the file does not offer a language choice or require user opt-in for English-only handling.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest presents this as a Seedance-focused skill spanning Seedance 2.0/1.5/1.0 variants. The code and CLI documentation are branded as a generic 'WeryAI video generation' tool with generic endpoints and a 'models' registry command, with no enforcement that selected models are Seedance lineage only.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says the skill 'Defaults to Seedance 2.0 (SEEDANCE_2_0)', implying callers can omit the model and still get Seedance 2.0 behavior. In the implementation, submitTask fails when 'model' is missing, and main repeats that validation for non-status commands, so no default model is actually applied.
Content: No source excerpt is available for this finding.