seedance2-skill
PassAudited by ClawScan on May 10, 2026.
Overview
This is a coherent Seedance video-generation helper, but users should know it can use their Volcengine API key to upload selected media and create generation tasks.
Before installing, be comfortable with selected prompts and media being sent to Volcengine Ark for video generation. Set ARK_API_KEY only in trusted sessions, request confirmation before API calls if cost/privacy matters, and avoid passing private files unless you intend to upload them.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A generation request may consume API credits and send the selected prompt/media to Volcengine if the agent chooses the API path.
The skill explicitly allows the agent to decide whether to call the provider API instead of only producing a prompt.
- **API 生成**：`scripts/seedance.py` 调用 Volcengine Ark API ... 用 API 生成还是输出 prompt 让用户去平台手动？ ... 全由你定。
Ask the agent to confirm before API generation, especially for paid requests or private media.
Anyone or any agent process with access to that environment variable could use the key within its provider permissions.
The script uses a Volcengine Ark API key from the local environment as a bearer credential.
key = os.environ.get("ARK_API_KEY") ... "Authorization": f"Bearer {api_key}"Use a scoped/limited API key if available, keep it out of logs, and unset or rotate it when no longer needed.
On macOS, downloaded files may open automatically; shell-based path handling is less safe than a no-shell subprocess call.
After downloading a generated video, the script automatically runs the macOS `open` command through a shell.
if sys.platform == "darwin":
os.system(f'open "{filepath}"')Use trusted download paths, and consider removing auto-open behavior or replacing it with a safer subprocess call.