byted-bp-seedance-viral-creative-rewrite-skill

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses localized subprocess calls to manage its internal environment and execute modular tasks.
  • The scripts/ensure_runtime.py script creates a local Python virtual environment (.venv) and installs necessary dependencies to ensure skill isolation.
  • scripts/confirm_generation.py and scripts/run_rewrite_video.py use subprocess.run to coordinate execution between various internal Python scripts.
  • scripts/extract_video_frames.py invokes ffmpeg (via imageio-ffmpeg) to process user-provided template videos into timestamped frames for analysis.
  • [EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to fetch dependencies and communicate with the generation service.
  • scripts/ensure_runtime.py uses pip to install packages from PyPI (e.g., httpx, pydantic, imageio) into the local virtual environment.
  • scripts/media_cache.py uses the httpx library to download user-provided template videos or product images from remote URLs into a local cache directory.
  • scripts/seedance_runtime.py transmits the generated prompt and product image (as a Base64-encoded data URL) to the BytePlus API endpoints (ark.ap-southeast.bytepluses.com).
  • [SAFE]: The skill demonstrates several security-positive patterns.
  • Human-in-the-loop Review: The skill instructions and state machine (references/state_machine.md) enforce a mandatory "BRIEF_READY" state where the user must review and explicitly confirm the rewrite plan before the final generation service is called.
  • Secret Management: The skill explicitly instructs users to manage sensitive ARK_API_KEY credentials via local .env files rather than hardcoding them or pasting them into conversations.
  • Platform Alignment: All external links and API targets are consistent with the skill author (bytedance) and point to official BytePlus/ModelArk documentation and consoles.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 06:16 AM
Security Audit — agent-trust-hub — byted-bp-seedance-viral-creative-rewrite-skill