seedance-2-5-video-edit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly documents an --api-key CLI flag and shows the API key format (sk-api-*), which encourages passing real secrets on the command line (or embedding them in commands/config) and therefore could require the LLM to include secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path videogen.py cmd_video → AiHiveClient.generate_video → POST /openapi/v1/generation/video ingests outsider-authored free text via the --prompt argument (and optional --param key=value) submitted by the user.