seedance-2-5-skill

The code appears to be a legitimate Atlas Cloud REST executor with no clear indicators of intentional malware or obfuscation. However, it introduces substantial security-relevant risks common to helper libraries: (1) download(url,destination) enables SSRF via unvalidated fetch(url) and arbitrary file writes via unvalidated destination; (2) uploadMedia(source) may allow path traversal/root escape because it resolves a caller-controlled path against root without ensuring containment before readFileSync, enabling potential local file exfiltration to the remote upload endpoint; and (3) configurable base URL and verbose error propagation can increase operational exposure. These issues warrant strict input validation/allowlisting by the consuming application.