seedance-video
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
volcengine-python-sdk[ark]package. This is the official Python SDK provided by Volcengine (a well-known cloud service by ByteDance) to interact with their Ark AI platform. - [COMMAND_EXECUTION]: The script
scripts/generate_video.pyexecutes network operations to communicate with the official Volcengine API endpoint (https://ark.cn-beijing.volces.com/api/v3) and uses therequestslibrary to download generated media files to the user's workspace. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface in
scripts/generate_video.pywhere it accepts text prompts and image URLs. - Ingestion points: CLI arguments
promptand--image-urlinscripts/generate_video.py. - Boundary markers: Absent; the prompt text is interpolated directly into the API request payload.
- Capability inventory: The skill has the ability to write files to disk (
download_filefunction) and perform network requests to the model provider. - Sanitization: No explicit sanitization or filtering is performed on the input strings before they are sent to the remote API. This is a standard risk for LLM-based generation tools where external content might influence the model's output.
Audit Metadata