seedance-2-0-video-reference-to-video

The skill is mostly coherent with its stated video-generation purpose and uses a normal PyPI dependency, but it routes API credentials and uploaded media through AI Hive rather than clearly documented direct Seedance endpoints. That makes it better classified as suspicious/medium risk due to intermediary data flow ambiguity, not confirmed malware.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.