The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a version manifest from https://raw.githubusercontent.com/HiAPIAI/hiapi-skills/main/skills.json to check for available updates.
[COMMAND_EXECUTION]: The installer script scripts/install.mjs utilizes child_process.execSync to execute git clone for downloading the skill's source code.
[REMOTE_CODE_EXECUTION]: Installation instructions suggest using npx to run code directly from the vendor's GitHub repository (npx -y github:HiAPIAI/hiapi-seedance-2-0-video-skill), which involves the execution of remote scripts.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled input, such as text prompts and media URLs, which are subsequently sent to the remote HiAPI service.
Ingestion points: User-supplied arguments --prompt, --first-frame-url, and other media flags in scripts/hiapi-seedance-2-video.mjs.
Boundary markers: None identified in the prompt construction.
Capability inventory: Performs network requests via fetch and writes files to the local outputs/ directory using fs/promises.writeFile.
Sanitization: Implements basic parameter normalization for technical constraints (e.g., resolution, duration) in scripts/lib/seedance-2-video.mjs, though it does not sanitize the natural language prompt content.

hiapi-seedance-2-0-video