Video-Generator-SeeDance

Pass

Audited by Gen Agent Trust Hub on Jun 3, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: The script scripts/generate_video.py transmits user-provided text prompts and image URLs to the Volcano Engine API at ark.cn-beijing.volces.com. It also reads API credentials from a local config.json file to authenticate these requests. This behavior is consistent with the skill's stated purpose of video generation via an external API.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run a Python script (scripts/generate_video.py). The script processes command-line arguments using argparse and executes logic for API interaction, task polling, and file saving.
  • [EXTERNAL_DOWNLOADS]: The skill downloads the final video file from a remote URL provided by the Volcano Engine API response. This is a standard operation for cloud-based media generation services.
  • [CREDENTIALS_UNSAFE]: The skill implements a standard security practice by requiring users to store sensitive API keys in a local config.json file rather than hardcoding them in the source code. An example configuration (config.example.json) is provided with placeholders.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 3, 2026, 02:38 AM
Security Audit — agent-trust-hub — Video-Generator-SeeDance