byteplus-seedance-video
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Node.js script
scripts/create_seedance_video.mjsdesigned to be executed by the agent to perform video generation tasks. The script interacts with the filesystem to read reference media and environment variables, and writes result data to a user-specified path. - [EXTERNAL_DOWNLOADS]: The
scripts/create_seedance_video.mjsscript can download media from arbitrary URLs provided via the--image,--video, or--audioarguments to use as references for video generation. - [DATA_EXFILTRATION]: The skill uses
ARK_API_KEY,BYTEPLUS_ACCESS_KEY, andBYTEPLUS_SECRET_KEYto authenticate requests to BytePlus Ark and TOS endpoints (*.bytepluses.comand*.byteplusapi.com). These credentials are sent using HMAC signing or Bearer tokens, which is the standard and necessary method for these services. - [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it processes prompts and external media provided at runtime.
- Ingestion points: Arguments passed to
scripts/create_seedance_video.mjs, specifically--prompt,--image,--video, and--audio. - Boundary markers: No explicit safety delimiters or warnings are present in the script for the ingested prompt or media content.
- Capability inventory: The script performs network requests (
fetch), file reads (fs.readFileSync), and file writes (fs.writeFileSync). - Sanitization: The script uses standard URL encoding and JSON stringification but does not perform content-level sanitization of the input prompt strings.
Audit Metadata