seedance-v2

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the execution of the runcomfy CLI tool to process video generation requests.
  • [EXTERNAL_DOWNLOADS]: The documentation guides users to install the @runcomfy/cli package from the npm registry and references external image/video URLs for processing.
  • [PROMPT_INJECTION]: The skill documents an attack surface for indirect prompt injection through user-provided prompts and external media URLs.
  • Ingestion points: Processes prompt, image_url, video_url, and audio_url fields defined in SKILL.md.
  • Boundary markers: Inputs are passed as JSON strings to the CLI to prevent shell expansion.
  • Capability inventory: Invokes the runcomfy CLI, which performs network requests to model-api.runcomfy.net and writes generated files to a local directory.
  • Sanitization: Uses JSON encoding for prompt transmission to mitigate command injection risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 10:56 AM
Security Audit — agent-trust-hub — seedance-v2