seedance-product-video
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local bash script (
ofox-video.sh) to interact with the vendor's API. This includes probing for the script in multiple local directories such as~/.agents/skills/and~/.claude/skills/. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data, including product photos and text descriptions, which are used to generate video prompts for an external model. The attack surface is mitigated by explicit instructions for literal accuracy.
- Ingestion points: User-provided photo paths, URLs, and descriptive text are ingested through the creative brief process in
SKILL.md. - Boundary markers: The skill uses an
AVOIDblock to list prohibited elements and consistency locks in thePRODUCTblock to ensure stable generation. - Capability inventory: The skill has the capability to execute shell commands via
ofox-video.sh, which performs network operations and file writes. - Sanitization: Prompting rules require neutral, literal descriptions and specific SCENE constraints to prevent background hallucination.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to the vendor's API (
api.ofox.ai) to submit jobs and download generated video files. These operations target established vendor infrastructure.
Audit Metadata