seedance
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
zjandrew-seedance-clipackage from PyPI viauvorpipx. This package is the primary tool for the skill's functionality and is directly associated with the skill's author. - [COMMAND_EXECUTION]: The skill instructions involve executing
seedance-clifor video generation, configuration management, and task polling. It also providesffmpegcommand templates for frame extraction to allow the agent to inspect generated content. - [CREDENTIALS_UNSAFE]: The skill handles
ARK_API_KEYconfiguration. It advises using environment variables or a specific CLI configuration command that masks the key, and it explicitly warns against storing credentials in shell history, aligning with security best practices. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect injection as it processes user-provided prompts and external media assets (images, videos, audio) which are then passed to the
seedance-clisubprocess. - Ingestion points: User-supplied text prompts and local/remote media paths (SKILL.md).
- Boundary markers: None explicitly defined for user data in the CLI command construction.
- Capability inventory: Subprocess execution of
seedance-cliandffmpeg(SKILL.md). - Sanitization: Not explicitly handled in the skill's markdown; relies on the external CLI tool and the underlying API service's content filtering.
Audit Metadata