seedance-video

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the volcengine-python-sdk[ark] package. This is the official Python SDK provided by Volcengine (a well-known cloud service by ByteDance) to interact with their Ark AI platform.
  • [COMMAND_EXECUTION]: The script scripts/generate_video.py executes network operations to communicate with the official Volcengine API endpoint (https://ark.cn-beijing.volces.com/api/v3) and uses the requests library to download generated media files to the user's workspace.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface in scripts/generate_video.py where it accepts text prompts and image URLs.
  • Ingestion points: CLI arguments prompt and --image-url in scripts/generate_video.py.
  • Boundary markers: Absent; the prompt text is interpolated directly into the API request payload.
  • Capability inventory: The skill has the ability to write files to disk (download_file function) and perform network requests to the model provider.
  • Sanitization: No explicit sanitization or filtering is performed on the input strings before they are sent to the remote API. This is a standard risk for LLM-based generation tools where external content might influence the model's output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:45 AM