seedance
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard system utilities, specifically
curlandjq, to interact with external APIs and process JSON data. These operations are limited to the intended functionality of the skill. - [EXTERNAL_DOWNLOADS]: Interactions are directed to
ark.ap-southeast.bytepluses.com, which is an official domain for BytePlus (the international division of ByteDance) AI services. Downloads are limited to the resulting video files generated by the service. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes user-supplied text prompts and image URLs for video generation as described in the request examples in
SKILL.md. - Boundary markers: No specific delimiters are used to wrap user-provided text within the generated JSON payloads.
- Capability inventory: The skill utilizes
curlfor network requests and writes temporary request/output files to the/tmp/directory. - Sanitization: No explicit sanitization or filtering of user-provided strings is defined in the instructions; safety is managed by the destination API's internal filters.
Audit Metadata