seedance-2-5-audio-reference-to-video

SUSPICIOUS. The skill’s stated purpose and required media/API-key usage are mostly coherent for a video-generation integration, but trust in the actual remote service is not established: the core API endpoints/operator could not be verified from the evidence, while the bundled script that handles uploads and credentials was not provided. This is not confirmed malware, but the unclear publisher/data-flow chain makes it medium risk.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.