Aguara Watch

seedance2-api

skills-sh:hexiaochun_seedance2-api__seedance2-api

View source
A
100/100

First Seen

Feb 19, 2026

Last Scanned

Feb 20, 2026

Findings

2

Score

100/100

LOW 2

Findings (2)

LOW
Runtime URL controlling behavior
L30

Detects URLs fetched at runtime that control or influence agent behavior without pinning

Get your API Key: https:// + prompt
FIX

Avoid loading configuration or behavior-controlling content from runtime URLs. Bundle required configurations locally or pin remote config to versioned, integrity-verified endpoints.

FP?

Likely FP if the URL in the match is a documentation link or example URL (e.g., example.com) rather than an actual runtime-fetched configuration endpoint.

LOW
pip install arbitrary package
L32

Detects pip install of arbitrary packages that modify the host environment

pip install re
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.