seedance-v2
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the execution of the
runcomfyCLI tool to process video generation requests. - [EXTERNAL_DOWNLOADS]: The documentation guides users to install the
@runcomfy/clipackage from the npm registry and references external image/video URLs for processing. - [PROMPT_INJECTION]: The skill documents an attack surface for indirect prompt injection through user-provided prompts and external media URLs.
- Ingestion points: Processes
prompt,image_url,video_url, andaudio_urlfields defined inSKILL.md. - Boundary markers: Inputs are passed as JSON strings to the CLI to prevent shell expansion.
- Capability inventory: Invokes the
runcomfyCLI, which performs network requests tomodel-api.runcomfy.netand writes generated files to a local directory. - Sanitization: Uses JSON encoding for prompt transmission to mitigate command injection risks.
Audit Metadata