Dlazy Seedance 2.0

ByteDance's latest video generation model. Supports multi-modal reference (images, video, audio) to generate videos, as well as first/last frame and text-to-...

Security Scan

The skill is mostly coherent with a CLI-backed video generation client, but there are small mismatches (declared requirements vs. runtime instructions and provenance claims) and a few operational risks you should review before installing or running it.

Purpose & Capability

The name/description (video generation via a CLI) matches the actions described (invoking a dlazy CLI that calls api.dlazy.com and uploads media to oss.dlazy.com). Declared required binaries (npm, npx) are appropriate. However, the description repeatedly asserts 'ByteDance's latest model' while metadata and URLs point to dlazy/dlazyai; that provenance claim may be inaccurate or overstated and should be verified.

Instruction Scope

SKILL.md instructs the agent to run the dlazy CLI and to upload local files passed as arguments (images/videos/audios) to dlazy's storage — this is expected for a cloud media-generation CLI. The instructions do not ask the agent to read arbitrary unrelated system files, but they do instruct use of local file paths (which will be read and uploaded if provided). The SKILL also contains explicit agent guidance (CRITICAL INSTRUCTION) to execute the CLI command; that is narrow but prescriptive.

Install Mechanism

Registry metadata shows no install spec, but SKILL.md metadata declares an npm install command and an npx alternative pinned to @dlazy/cli@1.0.6. This mismatch between the registry install metadata and the SKILL.md metadata is an inconsistency. Installing an npm package (especially global) can execute package install scripts — moderate risk. Using npx is lower-friction and avoids persisting a global binary if you prefer.

Credentials

The registry lists no required environment variables, but the SKILL.md explicitly describes an API key mechanism (dlazy auth set and DLAZY_API_KEY env var) and a config file (~/.dlazy/config.json) where the key is stored. The skill will therefore rely on a secret API key and on a user-local config file; the absence of that in the declared 'requires.env' is a discrepancy and should be corrected/acknowledged before trusting the skill.

Persistence & Privilege

always is false and the skill is instruction-only (no code bundled), so it does not force persistent presence. If you choose to globally install the npm CLI, that creates a persistent binary on the system (user-installed), but the skill itself does not request system-wide privileges or attempt to modify other skills/configs.

What to consider before installing

This skill appears to be a thin wrapper that calls a hosted dlazy service and is coherent with its stated function, but before installing or running it: 1) Verify provenance — check the GitHub repo and dlazy.com to confirm the project/organization and whether the 'ByteDance' attribution is accurate. 2) Prefer running with npx (npx @dlazy/cli@1.0.6 ...) if you don't want to install a global package; review the npm package source and README for postinstall scripts. 3) Be aware the CLI requires an API key (DLAZY_API_KEY or dlazy auth set) which will be stored in ~/.dlazy/config.json — keep that file secure and rotate/revoke keys as needed. 4) Do not pass sensitive local files to the CLI unless you accept they will be uploaded to oss.dlazy.com. 5) If you need higher assurance, inspect the GitHub source and the npm package contents for unexpected behavior (network calls to other domains, install scripts, or code that reads unexpected local paths).

English · 中文

ByteDance's latest video generation model. Supports multi-modal reference (images, video, audio) to generate videos, as well as first/last frame and text-to-video modes.

Trigger Keywords

• seedance-2.0

Authentication

All requests require a dLazy API key, configured through the CLI:

dlazy auth set YOUR_API_KEY

The CLI saves the key in your user config directory (~/.dlazy/config.json on macOS/Linux, %USERPROFILE%\.dlazy\config.json on Windows), with file permissions restricted to your OS user account. You can also supply the key per-invocation via the DLAZY_API_KEY environment variable.

Getting Your API Key

1. Sign in or create an account at dlazy.com
2. Go to dlazy.com/dashboard/organization/api-key
3. Copy the key shown in the API Key section

Each key is scoped to your dLazy organization and can be rotated or revoked at any time from the same dashboard.

About & Provenance

• CLI source code: github.com/dlazyai/cli
• Maintainer: dlazyai
• npm package: @dlazy/cli (pinned to 1.0.6 in this skill's install spec)
• Homepage: dlazy.com

You can install on demand without persisting a global binary by running:

npx @dlazy/cli@1.0.6 <command>

Or, if you prefer a global install, the skill's metadata.clawdbot.install field declares the exact pinned version (npm install -g @dlazy/cli@1.0.6). Review the GitHub source before installing.

How It Works

This skill is a thin client over the dLazy hosted API. When you invoke it:

• Prompts and parameters you provide are sent to the dLazy API endpoint (api.dlazy.com) for inference.
• Any local file paths you pass to image / video / audio fields are uploaded to dLazy's media storage (oss.dlazy.com) so the model can read them — the same flow as any cloud-based generation API.
• Generated output URLs returned by the API are hosted on oss.dlazy.com.

This is the standard SaaS pattern; the skill itself does not access network or filesystem resources beyond what the dLazy CLI already handles. See dlazy.com for the full service terms.

Usage

CRITICAL INSTRUCTION FOR AGENT: Execute dlazy seedance-2.0 to get the result.

dlazy seedance-2.0 -h

Options:
  --prompt <prompt>                    Prompt
  --generation_mode <generation_mode>  Generation Mode [default: components] (choices: "components", "frames")
  --images <images...>                 Images [image: url or local path] (max 9) [hidden when generation_mode="frames"]
  --videos <videos...>                 Videos [video: url or local path] (max 3) [hidden when generation_mode="frames"]
  --audios <audios...>                 Audios [audio: url or local path] (max 3) [hidden when generation_mode="frames"]
  --firstFrame <firstFrame>            First Frame [image: url or local path] [only when generation_mode="frames"]
  --lastFrame <lastFrame>              Last Frame [image: url or local path] [only when generation_mode="frames"]
  --resolution <resolution>            Resolution [default: 720p] (choices: "480p", "720p", "1080p")
  --ratio <ratio>                      Aspect Ratio [default: 16:9] (choices: "21:9", "16:9", "4:3", "1:1", "3:4", "9:16")
  --duration <duration>                Duration (s) [default: 5] (choices: "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15")
  --generate_audio <generate_audio>    Generate Audio [default: true]
  --input <spec>                       JSON payload: inline string, @file, or - (stdin)
  --dry-run                            Print payload + cost estimate without calling API
  --no-wait                            Return generateId immediately for async tasks
  --timeout <seconds>                  Max seconds to wait for async completion (default: "1800")
  -h, --help                           display help for command

Output Format

{
  "ok": true,
  "kind": "urls",
  "data": {
    "urls": [
      "https://oss.dlazy.com/result.mp4"
    ]
  }
}

Examples

dlazy seedance-2.0 --prompt 'prompt content' 

Error Handling

Code	Error Type	Example Message
401	Unauthorized (No API Key)	ok: false, code: "unauthorized", message: "API key is missing or invalid"
501	Missing required parameter	error: required option '--prompt <prompt>' not specified
502	Local file read error	Error: Image file/Video file not found: C:\path\to\your\file
503	API request failed (no balance)	ok: false, code: "insufficient_balance"
503	API request failed (server error)	HTTP status code error (500 server crash)
504	Asynchronous task execution failed	=== Generation Failed === / {Specific error reason returned by backend, for example "Prompt violates safety policy"}

AGENT CRITICAL INSTRUCTION:

1. If the execution result returns code: "insufficient_balance", you MUST explicitly inform the user that their credits are insufficient and guide them to recharge: https://dlazy.com/dashboard/organization/settings?tab=credits
2. If the execution result returns code: "unauthorized" or indicates missing API key, you MUST inform the user to get their API key from https://dlazy.com/dashboard/organization/api-key and save it using dlazy auth set <key> and resume the task.

Tips

Visit https://dlazy.com for more information.