skills/bytedance/agentkit-samples/byted-bp-seedance-viral-creative-rewrite-skill/Gen Agent Trust Hub
byted-bp-seedance-viral-creative-rewrite-skill
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
subprocessmodule to manage internal execution flows and to run the FFmpeg utility for extracting video frames. These operations are implemented using list-based arguments rather than shell strings, adhering to security best practices for preventing command injection. - [EXTERNAL_DOWNLOADS]: The skill includes a dedicated runtime preparation script (
scripts/ensure_runtime.py) that creates a local virtual environment and installs necessary dependencies from arequirements.txtfile. This is a standard procedure for managing a skill's execution environment. - [INDIRECT_PROMPT_INJECTION]: The skill uses the host agent to analyze user-provided template videos and images. While the ingestion of external media content is a known vector for indirect prompt injection, the skill mitigates this by using structured JSON serialization for prompt construction and applying specific sanitization rules for creative template transfer.
- [DATA_EXFILTRATION]: The skill transmits prompt parameters and product images to the BytePlus API at
ark.ap-southeast.bytepluses.com. This transmission is the core intended function of the skill and targets the official service infrastructure of the recognized vendor.
Audit Metadata