seedance-video-creator

SUSPICIOUS. The skill’s video-creation purpose is coherent, but it relies on a third-party reverse-API Docker service and forwards a copied website session credential, prompts, and uploaded files through that service or an optional duckcloud.fun gateway instead of an official published API. That combination is disproportionate and creates high credential-forwarding and supply-chain risk, though there is not enough evidence to call it confirmed malware.

The fragment is a permissive command-authorization configuration with a hardcoded bearer credential and external image-upload requests. These are significant security risks, particularly credential exposure and excessive shell privileges, but the supplied content does not provide clear evidence of malware or intentional sabotage. Verify the external service, rotate the exposed token, restrict commands to exact required operations, and avoid granting arbitrary Python, chmod, process-kill, systemctl, and Docker access.