byted-seedance-video-generate
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
video_generate.pyscript performs network requests to ByteDance's official Volcengine API platform (ark.cn-beijing.volces.com) to submit video generation tasks and retrieve status. This communication is essential for the skill's primary function and targets a known, official vendor domain. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text prompts and resource URLs (images, videos, audios) which are passed to an external generation model. This creates a surface for potential indirect injection where the external model might interpret data as instructions.
- Ingestion points: The
paramslist in thevideo_generatefunction, which receives data from user input. - Boundary markers: There are no explicit delimiters or boundary markers used when interpolating user prompts into the API request structure.
- Capability inventory: The skill possesses network communication capabilities via
httpxand instructions for file system writes to manage environment variables. - Sanitization: No sanitization or validation is performed on the content of the prompt string or the resource URLs before they are transmitted to the API.
Audit Metadata