Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Seedance Video Generation BytePlus
v1.0.1Generate AI videos using BytePlus Seedance API (International). Use when the user wants to: (1) generate videos from text prompts, (2) generate videos from images (first frame, first+last frame, reference images), or (3) query/manage video generation tasks. Supports Seedance 1.5 Pro (with audio & draft mode), 1.0 Pro, 1.0 Pro Fast, and 1.0 Lite models.
⭐ 0· 1k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description and the included Python CLI line up: the code posts generation tasks to the BytePlus Ark API and handles polling and downloads. Requiring an API key for BytePlus (ARK_API_KEY) is appropriate for the stated purpose. However, registry metadata claims no required environment variables while both SKILL.md and the Python code explicitly require ARK_API_KEY — that mismatch is unexpected.
Instruction Scope
SKILL.md and the CLI focus on creating/listing/querying BytePlus generation tasks, converting local images to base64, polling, and downloading results — all within the stated purpose. Additional documentation (how_to_send_video_via_feishu_app.md) shows a workflow that reads local generated video files and instructs using an external `message` tool to upload them to Feishu, which involves reading local workspace files and calling Feishu APIs. That Feishu workflow is optional but present in the bundle and introduces extra IO and external network endpoints beyond BytePlus.
Install Mechanism
No install spec or remote downloads; this is an instruction+source bundle. The code is included in the skill package (seedance_byteplus.py) and would run locally when invoked. No third-party packages are pulled automatically by an installer.
Credentials
The runtime requires ARK_API_KEY (BytePlus) according to SKILL.md and the code (get_api_key checks ARK_API_KEY), but the registry metadata lists no required env variables — this is an inconsistency and a documentation/manifest mismatch. The included Feishu guide further references Feishu app credentials (app_id/app_secret or app_access_token) and OpenClaw Feishu settings for uploading generated videos; those credentials are not declared anywhere in the skill manifest either. The number and type of credentials referenced (ARK_API_KEY plus optional Feishu tokens) are plausible for the workflows, but the manifest should declare them explicitly so users know what secrets the skill expects.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It does not request persistent system-wide privileges or try to modify other skills. It reads/writes files only in user-specified download paths (e.g., workspace or Desktop) and does network calls to the documented BytePlus endpoints.
What to consider before installing
This package mostly does what it claims (calls BytePlus/Seedance to create and poll video generation tasks), but pay attention to the following before installing:
- Manifest mismatch: The code and SKILL.md require ARK_API_KEY, but the skill registry metadata lists no required environment variables. Treat ARK_API_KEY as required and ensure you only provide a BytePlus key with appropriate, limited permissions and billing awareness.
- Optional Feishu flow: The bundle contains a guide to upload generated videos to Feishu that reads local files and uses Feishu app credentials (app_id / app_secret / app_access_token) stored in OpenClaw settings; those credentials are not declared in the manifest. If you plan to use the Feishu integration, verify the message tool and Feishu app settings separately and understand that files under your workspace will be uploaded to Feishu/CDN.
- Local file access: The CLI converts local images to base64 and downloads generated videos to user-specified paths (e.g., ~/.claude/skills or workspace). Make sure sensitive images/videos are not placed in those locations if you don’t want them uploaded.
- Network calls & billing: The tool makes outbound HTTP requests to the BytePlus Ark API (BASE_URL = https://ark.ap-southeast.bytepluses.com). Generating videos may incur cost — confirm your BytePlus account/billing and rate limits.
- Source review: The Python code is included; if you will run it, consider inspecting the file yourself or running it in an isolated environment. There are no pre-scan injection flags, but the manifest inconsistency (undeclared env vars) lowers trust until corrected.
If you want higher assurance, ask the skill author or registry maintainer to (1) update the skill manifest to declare ARK_API_KEY as required, (2) explicitly document optional Feishu credentials (or move the Feishu guide to a separate integration package), and (3) provide an official homepage/source URL so you can verify origin and updates.Like a lobster shell, security has layers — review code before you run it.
latestvk971ft3j498bdj59frptkyetcd811q4j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
