seedance-2-5-image-to-video
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided image URLs and motion prompts, which represents a standard attack surface for indirect prompt injection.
- Ingestion points: The
prompt(string) andimage(URL) fields in the JSON input for theruncomfycommand. - Boundary markers: The skill includes a dedicated 'Security & Privacy' section explicitly instructing the agent to treat these inputs as untrusted data and to ignore any instructions embedded within the images or text.
- Capability inventory: The skill is limited to calling the
runcomfytool to process data via the RunComfy API. - Sanitization: Documentation specifies that the CLI transmits the input as a JSON body over HTTPS without shell expansion.
- [COMMAND_EXECUTION]: The skill utilizes the
runcomfycommand-line interface to execute image-to-video tasks. - Evidence: Use of
runcomfy run bytedance/seedance-2.5/image-to-video/720pwith JSON input. - Context: This is the primary intended functionality of the skill and involves a tool associated with the vendor's platform.
Audit Metadata