v1.0.0

WaveSpeedAI Seedance 1.5 Pro Video Generation

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:20 AM.

Analysis

This is a coherent WaveSpeed video-generation skill, but using it requires a WaveSpeed API key and may upload images or prompts to WaveSpeed's service.

GuidanceBefore installing, confirm you are comfortable giving the agent access to a WaveSpeed API key and sending prompts or images to WaveSpeed. This looks purpose-aligned, but use non-sensitive media unless you have reviewed the provider's privacy and billing terms.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

export WAVESPEED_API_KEY="your-api-key"

The skill expects a WaveSpeed API key to authenticate generation requests. This is aligned with the stated WaveSpeed integration, but it is sensitive account authority and is not declared in the registry requirements.

User impactThe agent or user environment may use your WaveSpeed account/API key to generate videos, which could consume account credits or access account-backed service functionality.

RecommendationUse a dedicated WaveSpeed key with appropriate limits if possible, keep it out of chat logs, and revoke or rotate it if you no longer need the skill.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

const imageUrl = await wavespeed.upload("/path/to/photo.png");

The image-to-video workflow can upload a local image to WaveSpeed and then use the resulting URL for generation. This is expected for the feature, but it means user-provided media and prompts can leave the local environment.

User impactPersonal or confidential images and prompts may be sent to WaveSpeed's external service when using image-to-video generation.

RecommendationOnly upload images and prompts you are comfortable sharing with the provider, and review WaveSpeed's data handling terms for sensitive content.