seedance-seeding-video

SUSPICIOUS: the skill’s purpose and high-level capabilities are coherent for a hosted video-generation workflow, and its only explicit install step is a normal PyPI package. The main risk is incomplete transparency: the bundled script that receives API keys, uploads media, and makes network calls is missing, so endpoint ownership and data flows to official AI Hive/Seedance infrastructure cannot be verified.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.