seedance-2-0-text-to-video

SUSPICIOUS. The skill’s core function is coherent, and its install path is relatively normal, but the main trust issue is data-flow integrity: prompts, media, and API credentials are routed through an unverified third-party 'AI Hive OpenAPI' rather than a clearly official Seedance/ByteDance endpoint. That makes this more than a simple framework guide and raises medium risk despite otherwise proportionate scope.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.