seedance-video
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and external media URLs (images, audio, video) to generate video content. This creates a potential attack surface for indirect prompt injection via user-controlled data.
- Ingestion points: Prompt text and media URLs (
image_url,audio_url,video_url) passed in thecontentarray in SKILL.md. - Boundary markers: None explicitly defined in the provided request templates to separate system instructions from user-provided data.
- Capability inventory: HTTP POST requests to
api.acedata.cloudusing thecurltool, as described in SKILL.md. - Sanitization: No explicit sanitization of user-provided strings or validation of media content is described in the skill instructions.
- [COMMAND_EXECUTION]: The skill provides
curlcommands to interact with the Ace Data Cloud API endpoints (/seedance/videosand/seedance/tasks). These commands are standard for the skill's intended purpose of media generation and task monitoring. - [EXTERNAL_DOWNLOADS]: The documentation references installation via
npx skillsandpip install mcp-seedance. These dependencies are part of the vendor's ecosystem and standard for the platform's usage.
Audit Metadata