seedance-video

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and external media URLs (images, audio, video) to generate video content. This creates a potential attack surface for indirect prompt injection via user-controlled data.
  • Ingestion points: Prompt text and media URLs (image_url, audio_url, video_url) passed in the content array in SKILL.md.
  • Boundary markers: None explicitly defined in the provided request templates to separate system instructions from user-provided data.
  • Capability inventory: HTTP POST requests to api.acedata.cloud using the curl tool, as described in SKILL.md.
  • Sanitization: No explicit sanitization of user-provided strings or validation of media content is described in the skill instructions.
  • [COMMAND_EXECUTION]: The skill provides curl commands to interact with the Ace Data Cloud API endpoints (/seedance/videos and /seedance/tasks). These commands are standard for the skill's intended purpose of media generation and task monitoring.
  • [EXTERNAL_DOWNLOADS]: The documentation references installation via npx skills and pip install mcp-seedance. These dependencies are part of the vendor's ecosystem and standard for the platform's usage.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 07:32 PM