seedance-prompting

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt includes deceptive/out-of-scope instructions—e.g., "Read CLAUDE.md for Tim's brand DNA and API keys" (requests access to secrets) and a self-improvement loop that reads/overwrites logs—actions unrelated to generating Seedance prompts and constituting hidden/exfiltration instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installation commands fetch and load remote skill content that controls the agent (curl -fsSL https://raw.githubusercontent.com/timkoda/seedance-skill/main/SKILL.md and https://raw.githubusercontent.com/timkoda/seedance-skill/main/references/seedance-rules.md, and the git clone https://github.com/timkoda/seedance-skill.git), which are downloaded at runtime and directly determine the prompts/behavior required for the skill to operate.