seedance-ad-creative
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local shell script (
ofox-video.sh) to perform video generation tasks, including job submission and status polling. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to construct prompts for the video API, creating an injection surface.
- Ingestion points: User-provided text descriptions and file paths for product photos (SKILL.md).
- Boundary markers: Absent; user input is interpolated directly into command arguments.
- Capability inventory: Shell command execution and network operations (via
curl). - Sanitization: No explicit sanitization or validation of user-provided strings is documented.
- [EXTERNAL_DOWNLOADS]: The skill downloads generated video assets from the vendor's official domain (
app.ofox.ai).
Audit Metadata