seedance-avatar-voice

SUSPICIOUS. The skill’s stated purpose is coherent, and its secret-handling guidance is more careful than typical docs, but the trust model is weak because users must clone and execute a personal GitHub skill repo and then provide live API keys to its local scripts. With no code or endpoint visibility, the main concern is supply-chain and credential-forwarding risk rather than confirmed malicious behavior.