Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
seedance2.0
v1.0.1字节跳动 Seedance 2.0 AI 视频生成技能，支持文生图、文生视频，提供申请指南和快速生成封装
⭐ 0· 27·0 current·0 all-time
byChen Meiyi@airoyi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md and README state the skill calls the Ark/Volcengine Seedance API and requires ARK_API_KEY and ARK_BASE_URL. But the registry metadata lists no required environment variables, no primary credential, and no required binaries. The bundle also contains a TypeScript implementation (seedance2.0.ts) and package.json — so this is not a pure instruction-only skill as claimed. Asking for Ark API credentials and performing downloads is consistent with the described purpose, but those credentials are not declared in the skill metadata (incoherent).
Instruction Scope
SKILL.md explicitly instructs reading environment variables (ARK_API_KEY, ARK_BASE_URL) and will download generated video files to local disk. The code bundle includes dotenv which will load a .env file from the working directory (and supports encrypted .env.vault via DOTENV_KEY), but DOTENV_KEY and .env handling are not documented in the metadata. The skill's runtime behavior can therefore read local .env secrets and write files — broader scope than the registry claims.
Install Mechanism
The registry lists no install spec (labelled instruction-only) yet the package contains code, node_modules/dotenv, and a package.json; README instructs using 'bun install' and running the TypeScript script. This mismatch (no declared required binaries or install steps) is an installation/integration coherence problem. The included dependency (dotenv) is a known package; there are no suspicious external download URLs, but missing install metadata is misleading and increases risk if the runtime environment is not prepared.
Credentials
SKILL.md requires ARK_API_KEY and ARK_BASE_URL (appropriate for calling the Seedance API) but the registry metadata lists no required environment variables or primary credential. Additionally, the included dotenv library supports DOTENV_KEY and encrypted .env.vault files (not mentioned in the SKILL.md), which could cause the skill to access/decrypt local secret files if misconfigured. The absence of declared credentials and omission of DOTENV-related behavior is a proportionality/visibility problem.
Persistence & Privilege
The skill does not request always: true and does not declare modifications to other skills or system-wide settings. It will write output video files to the local workspace (documented), which is expected for a generator skill. No elevated platform privileges are requested.
What to consider before installing
Do not install or run this skill without clarifying these mismatches. Specifically:
- Confirm provenance: ask the publisher for source/origin (homepage, repo) and why metadata claims 'instruction-only' while the bundle contains code and node_modules.
- Verify required credentials and install steps: the skill needs ARK_API_KEY and ARK_BASE_URL and requires Node/Bun to run; these should be declared in the registry metadata before use.
- Audit seedance2.0.ts: inspect the TypeScript code to confirm it only calls the expected Seedance endpoints and does not exfiltrate other environment variables or arbitrary files.
- Be cautious with .env: the package includes dotenv which will load .env from the working directory and can use DOTENV_KEY to decrypt .env.vault — avoid running this skill where unrelated secrets are present.
- Run in a sandboxed environment first (isolated workspace/container) and monitor outbound network requests, filesystem writes, and which environment variables are read.
- If you proceed, provide only a scoped Ark API key with minimal privileges and do not reuse high-privilege or cloud-wide credentials.
Fixes that would raise confidence: updated registry metadata listing ARK_API_KEY and required runtime (node/bun), an explicit install spec, and a publicly verifiable source repo (or signed release) so code provenance can be validated.seedance2.0.ts:53
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
ai-videovk97692ggyfr9pyk5fsv5rnssvn84b59edoubaovk97692ggyfr9pyk5fsv5rnssvn84b59elatestvk97692ggyfr9pyk5fsv5rnssvn84b59eseedancevk97692ggyfr9pyk5fsv5rnssvn84b59evolcenginevk97692ggyfr9pyk5fsv5rnssvn84b59e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.