Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Seedance API usage guide with expected external API calls and token setup, but users should be careful with real-person images, voices, videos, and the optional MCP install.
Install only if you are comfortable sending prompts and reference media URLs to AceDataCloud's Seedance service. Use a scoped API key when possible, keep the token out of prompts and commits, review provider data-handling terms, and only use real-person images, voices, or videos when you have the needed rights and consent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
metadata:
author: acedatacloud
version: "1.0"
compatibility: Requires ACEDATACLOUD_API_TOKEN in .env file (get an API key at https://platform.acedata.cloud/console/applications). Optionally pair with mcp-seedance for tool-use.
---
# Seedance Video Generation
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acedata.cloud/seedance/videos \
-H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"model": "doubao-seedance-2-0-260128", "content": [{"type": "text", "text": "a dancer performing contemporary ballet in a misty forest"}], "async": true}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acedata.cloud/seedance/videos \
-H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"model": "doubao-seedance-2-0-260128", "content": [{"type": "text", "text": "a dancer performing contemporary ballet in a misty forest"}], "async": true}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acedata.cloud/seedance/videos \
-H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"model": "doubao-seedance-2-0-260128", "content": [{"type": "text", "text": "a dancer performing contemporary ballet in a misty forest"}], "async": true}'
The skill explicitly encourages uploading reference images, audio, and video of real people to a third-party API, but it does not warn users about consent, privacy, biometric, copyright, or data-handling implications. In a media-generation skill centered on person/voice/video references, that omission materially increases the chance of users transmitting sensitive or non-consensual content to an external service.
pip install without ==version installs the latest release, which could include malicious changes.