Seedance 2.0 — AI Video by ByteDance

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to be a straightforward Atlas Cloud video-generation tool, with expected API-key, cloud-data, billing, and optional media-upload considerations plus minor source/model naming inconsistencies to verify.

Before installing, make sure you trust Atlas Cloud with the prompts and media you provide, understand that generation may incur charges, protect the ATLASCLOUD_API_KEY, and verify the repository identity because the source URL name does not clearly match the Seedance skill name.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone using the skill must protect the API key because it can authorize paid Atlas Cloud requests.

Why it was flagged

The script reads the Atlas Cloud API key from the environment and sends it as a bearer token to the service; this is expected for the integration but grants account/API usage authority.

Skill content

key = os.environ.get("ATLASCLOUD_API_KEY") ... "Authorization": f"Bearer {get_api_key()}"

Recommendation

Use a dedicated Atlas Cloud key if possible, keep it out of logs and shared files, and rotate it if exposed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Text prompts and referenced images may be processed by Atlas Cloud, so sensitive creative briefs or private media could leave the user’s environment.

Why it was flagged

The artifacts clearly disclose the provider data flow: user prompts and image URLs leave the local environment for cloud processing.

Skill content

This skill sends text prompts and image URLs to the Atlas Cloud API (`api.atlascloud.ai`) for video generation. No data is stored locally beyond the downloaded output files.

Recommendation

Avoid sending confidential prompts or private images unless the user is comfortable with Atlas Cloud processing them.

Note

ASI02: Tool Misuse and Exploitation

What this means

If the upload command is approved, the selected local file is transmitted to Atlas Cloud.

Why it was flagged

The script includes a local-file upload path, but it is purpose-aligned for media generation and prompts for confirmation before upload.

Skill content

print(f"About to upload '{file_path}' ({size_kb:.1f} KB) to Atlas Cloud (api.atlascloud.ai).")
        confirm = input("Proceed? [y/N]: ")

Recommendation

Only upload media files the user explicitly wants to use for video generation, and preserve the confirmation step.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The package identity is slightly harder to verify from naming alone.

Why it was flagged

The source/homepage repository name does not match the Seedance skill name, suggesting reused packaging or a provenance naming mismatch, though no hidden installer or malicious behavior is shown.

Skill content

name: seedance
source: "https://github.com/AtlasCloudAI/nano-banana-2-skill"
homepage: "https://github.com/AtlasCloudAI/nano-banana-2-skill"

Recommendation

Verify the repository, publisher, and version before installing, especially if relying on the advertised model identity.