video-generator-seedance

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a coherent Volcengine video-generation tool, but it requires a local API key, Python execution, and sending prompts or image URLs to the provider.

Before installing, make sure you trust this skill with a Volcengine API key, understand that prompts and image URLs are sent to Volcengine, keep config.json private, and review generated output paths to avoid overwriting files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

When invoked, the agent can run the Python generator locally and create or overwrite the chosen output video file.

Why it was flagged

The skill allows Python execution through Bash so the agent can run the generator script. This matches the skill's purpose, but it is still a local command capability with user-controlled arguments such as prompt and output path.

Skill content
allowed-tools: Bash(python *)
Recommendation

Use the skill for explicit video-generation requests, review output paths, and prefer running only the included script with intended parameters.

What this means

Video generation requests will use the user's Volcengine account and may consume quota or incur costs depending on that account's billing.

Why it was flagged

The script reads the user's Volcengine API key from config.json and uses it as a bearer token for API calls. This is disclosed and expected for the integration, but it grants account-backed API authority.

Skill content
self.api_key = self.config.get('api_key') ... "Authorization": f"Bearer {self.api_key}"
Recommendation

Use a dedicated or least-privileged API key if possible, keep config.json private, and monitor provider usage.

What this means

Setup may depend on locally available Python packages, and there is limited provenance information to help verify the package origin.

Why it was flagged

The package provenance and setup contract are sparse. This is not evidence of malicious behavior, but users must rely on the visible artifacts and their local Python environment rather than a pinned installer or homepage.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Review the included script before use and install any needed Python dependencies from trusted sources.