seedance-submitter

SUSPICIOUS: the skill’s media-generation purpose is coherent, but its actual trust boundary is not. The main issue is opaque routing through an unspecified PostPlus Cloud service, with local scripts and likely credentials/media forwarded to endpoints that are not identified or verifiable from the provided material. This is not confirmed malware, but the install/execution trust and data-flow integrity are too unclear to classify as benign.

No direct malicious/backdoor behavior is evident in this code fragment. The module’s main security exposure is design-level trust boundaries: it can read/write/create directories for caller-influenced filesystem paths without root confinement, and it forwards caller-controlled URLs to hosted generation/download bridge functions without visible URL allowlisting/validation. Additionally, it can delegate uploading arbitrary local files via uploadLocalMedia. These factors raise the risk of SSRF, arbitrary file read/write, and potential local file exfiltration if upstream authorization/input validation is insufficient.