seedance-2-5-first-last-frame-to-video

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The README explicitly documents a --api-key option and the sk-api-* key format, which encourages embedding real API keys into command-line arguments or outputs (verbatim), creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the CLI takes outsider-provided free text directly from --prompt and sends it as the content for the user message to the AI Hive chat/text or generation/video endpoints, i.e., videogen.py:cmd_video → client.generate_video(... prompt=...) (and similarly for cmd_chat via client.chat_text).