seedance-2-5-product-video

SUSPICIOUS: the skill’s stated capabilities broadly match a hosted video-generation workflow, but trust and data-flow verification are incomplete. The main concern is not overt malware but that a bundled script receives API keys and local media for a backend whose official public API documentation and model-ID claims were not clearly verified from the evidence.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.