Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

seedance-2-video-gen

v2.1.0

Seedance 2.0 AI video generation via EvoLink API. Three modes — text-to-video, image-to-video (1-2 images), reference-to-video (images + videos + audio). Aut...

4· 1.2k·3 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name, README, SKILL.md, required binaries (curl, jq) and the single env var EVOLINK_API_KEY all align with a remote video-generation API gateway (EvoLink) that needs network calls and an API key.
Instruction Scope
SKILL.md instructions are narrowly scoped to collecting generation parameters, checking EVOLINK_API_KEY, and running the bundled generation script while relaying progress lines. The instructions do not ask for unrelated credentials or system files.
!
Install Mechanism
Registry metadata states 'No install spec — instruction-only', but the package includes an executable installer (bin/cli.js), package.json, and a shell generation script (scripts/seedance-gen.sh). That means there is runnable code that will copy files into the user's skills directory and set executable bits — expected for an installer, but the metadata/instruction-only claim is inconsistent and warrants inspection before executing (especially via npx).
Credentials
Only EVOLINK_API_KEY is required and declared as the primary credential. No other secrets or unrelated environment variables are requested in SKILL.md or the visible code snippets.
Persistence & Privilege
The skill does not request always:true and does not appear to modify unrelated skills or system settings. The installer copies files into the OpenClaw skills directory (writes to user home), which is the expected behavior for an OpenClaw skill installer — be aware this writes files to disk.
Scan Findings in Context
[no_regex_findings] expected: Static pre-scan reported no injection signals. That doesn't guarantee safety — executable installer and a shell script are present and should be reviewed manually for unexpected endpoints or data collection.
What to consider before installing
This package largely matches its advertised purpose (EvoLink Seedance video generation) and only needs curl/jq and your EvoLink API key. However: (1) the registry lists the skill as instruction-only but the package contains an installer (bin/cli.js) and a shell script (scripts/seedance-gen.sh) — running via npx or the installer will execute code and copy files into your ~/.openclaw/skills (or another chosen path). (2) Before installing or running, open and review scripts/seedance-gen.sh and bin/cli.js to confirm they only call EvoLink endpoints (evolink.ai) and do not exfiltrate other local files or credentials. (3) If you plan to run via npx, prefer cloning the repo and inspecting files locally first or run inside a sandbox. (4) Confirm billing/usage on your EvoLink dashboard — the API key can incur charges. If you want, provide the full scripts (seedance-gen.sh) and I can scan them line-by-line for hidden endpoints or suspicious behavior.
bin/cli.js:69
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ahdqarh53dy32axmbpqfavn845znw

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Binsjq, curl
EnvEVOLINK_API_KEY
Primary envEVOLINK_API_KEY

SKILL.md

Seedance Video Generation

An interactive AI video generation assistant powered by the Seedance 2.0 model via EvoLink API.

After Installation

When this skill is first loaded, proactively greet the user and start the setup:

  1. Check if EVOLINK_API_KEY is set

    • If not set: "To generate videos, you'll need an EvoLink API key. It takes 30 seconds to get one — just sign up at evolink.ai/signup. Want me to walk you through it?"
    • If already set: "You're all set! What kind of video would you like to create?"
  2. That's it. One question. The user is now in the flow.

Do NOT list features, show a menu, or dump instructions. Just ask one question to move forward.

Core Principles

  1. Guide, don't decide — Present options and let the user decide. Don't make assumptions about their preferences.
  2. Let the user drive the creative vision — If they have an idea, use their words. If they need inspiration, offer suggestions and let them choose or refine.
  3. Smart context awareness — Recognize what the user has already provided and only ask about missing pieces.
  4. Intent first — If the user's intent is unclear, confirm what they want before proceeding.

Flow

Step 1: Check for API Key

If the user hasn't provided an API key or set EVOLINK_API_KEY:

  • Tell them they need an EvoLink API Key
  • Guide them to register at https://evolink.ai and get a key from the dashboard
  • Once they provide a key, proceed to Step 2

If the key is already set or provided, skip directly to Step 2.

Step 2: Understand Intent

Assess what the user wants based on their message:

  • Intent is clear (e.g., "generate a video of a cat dancing") → Go to Step 3
  • Intent is ambiguous (e.g., "I want to try Seedance") → Ask what they'd like to do: generate a new video, learn about model capabilities, etc.

Step 3: Gather Missing Information

Check what the user has already provided and only ask about what's missing:

ParameterWhat to tell the userRequired?
Mode / intentThree modes available: (1) Text-to-video — describe a scene, get a video; (2) Image-to-video — animate from 1-2 reference photos; (3) Reference-to-video — remix/edit/extend using images, video clips, and audio. Determine which mode fits from context, or ask if unclear.Yes
Video content (prompt)Ask what they'd like to see. If they need inspiration, suggest a few ideas for them to pick from or build on.Yes
DurationSupported: 4–15 seconds. Ask how long they want.Yes
ResolutionSupported: 480p / 720p. Ask their preference.Yes
AudioThe model can auto-generate voice, sound effects, and background music matching the video. Ask if they want audio enabled.Yes
Aspect ratioSupported: 16:9, 9:16, 1:1, 4:3, 3:4, 21:9, adaptive (model chooses best fit). Only mention if relevant or if user asks.Optional
Reference imagesImage-to-video: 1–2 images (JPEG/PNG/WebP, ≤30MB each). 1 image = first-frame animation; 2 images = first+last frame interpolation. Reference mode: 0–9 images.Conditional
Reference videosReference mode only: 0–3 videos (.mp4/.mov, 2–15s each, total ≤15s, ≤50MB each). Use for camera reference, motion reference, or as source video for editing/extension.Conditional
Reference audioReference mode only: 0–3 audio files (.wav/.mp3, 2–15s each, total ≤15s, ≤15MB each). Use for background music, sound effects, or voice reference.Conditional
Web searchText mode only: enables the model to search the web for enhanced timeliness (e.g., current weather, trending topics). Only mention if the user's prompt involves time-sensitive content.Optional

Smart gathering rules — STRICT:

  • Ask ALL missing parameters in ONE single message. Never split into multiple rounds of questions.
  • Never ask the same question twice. If the user already answered a parameter, it is final — do not re-ask it.
  • Offer defaults upfront so users can say "default is fine": 5s / 720p / audio on / 16:9. If the user says "default" or "just go", use these values immediately.
  • User gives everything at once → Confirm and generate immediately, no further questions.
  • User gives partial info → Ask only the remaining missing required fields, all in one message.
  • If user provides images/videos/audio, auto-detect the appropriate mode — no need to ask explicitly.
  • Duration, Resolution, Audio all have sensible defaults — if the user skips them, use defaults and proceed.

Step 4: Generate

Once all required information is confirmed:

  1. Before running the script, immediately send the user a message: "Got it! Starting your video now — this usually takes 1–3 minutes. I'll keep you posted while it generates 🎬"
  2. Run the generation script once. NEVER run it a second time unless the user explicitly asks to retry.
  3. While the script is running, actively relay progress to the user:
    • When you see TASK_SUBMITTED: → send: "✅ Task submitted! Generation has started."
    • When you see each STATUS_UPDATE: line → immediately send it to the user as a natural message, e.g. "Still generating... about 45 seconds remaining, hang tight!" — do not buffer these until the end. The user should never wait more than 30 seconds without hearing from you.
    • If you cannot stream line-by-line, send a reassuring message every ~30 seconds: "Still working on it, almost there..."
  4. When complete, share the video URL (valid for 24 hours) and generation time.

Script Usage

# Set API key
export EVOLINK_API_KEY=your_key_here

# Text-to-video (basic)
./scripts/seedance-gen.sh "A serene sunset over ocean waves" --duration 5 --quality 720p

# Text-to-video with web search (time-sensitive content)
./scripts/seedance-gen.sh "Today's weather in Tokyo with animated forecast" --duration 8 --quality 720p --web-search

# Image-to-video: 1 image (animate from first frame)
./scripts/seedance-gen.sh "The camera slowly zooms in, the scene comes to life" --image "https://example.com/scene.jpg" --duration 6 --quality 720p

# Image-to-video: 2 images (first + last frame interpolation)
./scripts/seedance-gen.sh "A smooth transition between day and night" --image "https://example.com/day.jpg,https://example.com/night.jpg" --duration 8 --quality 720p

# Reference-to-video: edit a video clip
./scripts/seedance-gen.sh "Replace the item in the box with the product from image 1" --image "https://example.com/product.jpg" --video "https://example.com/original.mp4" --duration 5 --quality 720p

# Reference-to-video: extend/remix with audio
./scripts/seedance-gen.sh "Continue the scene with this background music" --video "https://example.com/clip.mp4" --audio "https://example.com/bgm.mp3" --duration 10 --quality 720p

# Adaptive aspect ratio (model chooses best fit)
./scripts/seedance-gen.sh "A tall waterfall in a narrow canyon" --aspect-ratio adaptive --duration 5 --quality 720p

# Without audio
./scripts/seedance-gen.sh "Abstract art animation" --duration 6 --quality 720p --no-audio

# Force specific mode
./scripts/seedance-gen.sh "Remix these elements" --mode reference --image "url1" --video "url2" --duration 8 --quality 720p

Script Output Protocol

The script writes structured lines to stdout that you must parse and act on:

Line formatWhenYour action
TASK_SUBMITTED: task_id=<id> estimated=<Ns>Right after submissionConfirm to the user that generation has started. This means the API call succeeded — do NOT retry.
STATUS_UPDATE: <message>Every ~30s during generationRelay to the user — e.g., "Still working on your video, about 45 seconds remaining..."
VIDEO_URL=<url>On successExtract the URL and present the video to the user
ELAPSED=<Ns>On successOptionally mention how long it took
POLL_TIMEOUT: task_id=<id>Polling exceeded 10 minTell user: "Your video may already be done — check https://evolink.ai/dashboard (task: <id>)"
WARNING: ...On timeout (>10 min)Inform user generation may still be running, suggest checking back
ERROR: ... (stderr)On failureSurface the error message to the user

Critical: Once you see TASK_SUBMITTED:, the task is queued on the server. Do NOT run the script again. Retrying wastes the user's API credits. If the script times out locally, the video may still complete — tell the user to check their dashboard at https://evolink.ai/dashboard.

Error Handling

Provide friendly, actionable messages:

ErrorWhat to tell the user
Invalid/missing key (401)"Your API key doesn't seem to work. You can check it at https://evolink.ai/dashboard?utm_source=github&utm_medium=readme&utm_campaign=seedance2-video-gen-skill-for-openclaw"
Insufficient balance (402)"Your account balance is low. You can add credits at https://evolink.ai/dashboard?utm_source=github&utm_medium=readme&utm_campaign=seedance2-video-gen-skill-for-openclaw"
Rate limited (429)"Too many requests — let's wait a moment and try again"
Content blocked (400)"This prompt was flagged (realistic human faces are restricted). Try adjusting the description"
Video file too large (400)"One of the video files is too large. Each video must be ≤50MB and total video duration ≤15 seconds"
Image file too large (400)"One of the images is too large. Each image must be ≤30MB"
Service unavailable (503)"The service is temporarily busy. Let's try again in a minute"

Model Capabilities Summary

Use this when the user asks what the model can do:

  • Text-to-video (seedance-2.0-text-to-video): Describe a scene, get a video. Optional web search for time-sensitive content.
  • Image-to-video (seedance-2.0-image-to-video): 1 image = animate from first frame; 2 images = first+last frame interpolation.
  • Reference-to-video (seedance-2.0-reference-to-video): Multimodal — combine images (0–9), video clips (0–3), audio (0–3), and a text prompt to create, edit, or extend video. Use natural language in the prompt to reference inputs by number.
  • Audio generation: Auto-generates synchronized voice, sound effects, and background music (enabled by default).
  • Duration: 4–15 seconds
  • Resolution: 480p, 720p
  • Aspect ratios: 16:9, 9:16, 1:1, 4:3, 3:4, 21:9, adaptive
  • Limitation: Realistic human faces are restricted

References

  • references/api-params.md: Complete API parameter reference for all three models
  • scripts/seedance-gen.sh: Generation script with automatic model selection, polling, and error handling

Files

15 total
Select a file
Select a file to preview.

Comments

Loading comments…