seedance-product-video

SUSPICIOUS: The skill’s high-level behavior is coherent for a video-generation client, and the only explicit install is a normal PyPI dependency. However, there is a meaningful trust gap: the claimed AI Hive auth/config/model identifiers do not clearly match the public Seedance docs found, so credential and media flows cannot be confidently tied to an official same-org API path.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.