seedance-avatar-voice
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill implements secure management for Volcengine API keys. It uses a local .env file which is excluded from Git via .gitignore and provides a configuration script that uses getpass to prevent terminal echo of sensitive keys. Additionally, it sets restrictive file permissions (0o600) on the configuration file in Unix-like environments.- [COMMAND_EXECUTION]: The Python scripts perform legitimate command-line argument processing to facilitate video and audio synthesis. There is no evidence of arbitrary command execution or unsafe shell interpolation.- [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with well-known, official service endpoints belonging to Volcengine (volces.com and bytedance.com) for its core functionality.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text for prompts and narration; while this constitutes an ingestion surface, the operations are restricted to content generation via official APIs, with no capability for the data to influence host system security.
Audit Metadata