Seedance 2.0 Shot Design

Security checks across malware telemetry and agentic risk

Overview

This appears to be a Seedance video-prompt writing skill with no required credentials or automatic actions; the main cautions are user-directed remote install examples and an optional local validation script.

This looks safe for prompt-writing use. Verify the GitHub source if installing manually, do not run the optional Python validator unless you trust the code, and be mindful of privacy/consent if you use personal image, video, or voice references on external video platforms.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

If you follow the README install path, you may install whatever the remote repository serves at that time.

Why it was flagged

The install example pulls from a remote GitHub repository without a pinned commit. This is user-directed and common, but users should verify provenance.

Skill content
git clone https://github.com/woodfantasy/Seedance2.0-ShotDesign-Skills.git .claude/skills/seedance-shot-design
Recommendation

Install from a trusted source and prefer a reviewed release or pinned commit when possible.

#
ASI05: Unexpected Code Execution
Info
What this means

The skill can be used as an instruction-only prompt helper, but manually running the validation script would execute local Python code.

Why it was flagged

The repository documents an optional local Python validation tool while also stating that the agent does not need Python execution for normal prompt generation.

Skill content
python scripts/validate_prompt.py --text "your prompt" ... no Python execution required during prompt generation
Recommendation

Use the skill normally without granting execution permissions; only run the validation script if you trust and have reviewed the repository.