seedance-2-5-ecommerce-video

SUSPICIOUS: the skill’s high-level purpose matches a video-generation client, and the install path is ordinary, but trust in the actual backend is not well established from the evidence. The main concern is credential and media forwarding to an external AI Hive service whose official ownership/documentation for this specific API workflow is unclear; without the bundled script, data-flow integrity cannot be fully verified.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.