Seedance Video Generation

Generate AI videos using ByteDance Seedance. Use when the user wants to: (1) generate videos from text prompts, (2) generate videos from images (first frame, first+last frame, reference images), or (3) query/manage video generation tasks. Supports Seedance 1.5 Pro (with audio), 1.0 Pro, 1.0 Pro Fast, and 1.0 Lite models.

Install only if you are comfortable sending prompts and selected image files to Volcengine/ByteDance. Avoid unusual macOS download paths and be aware downloaded files may auto-open. Do not use the Feishu workflow unless you explicitly confirm the exact file, recipient/chat, and message, because it uploads the file to Feishu using configured app credentials.

Type: OpenClaw Skill Name: seedance-video-generation Version: 1.0.3 The skill bundle is classified as suspicious due to critical vulnerabilities that enable data exfiltration and arbitrary code execution via prompt injection. The `SKILL.md` and `seedance.py` script allow reading arbitrary local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) specified by user input (via `--image`, `--last-frame`, `--ref-images` arguments) and base64 encoding their content, then sending it to `https://ark.cn-beijing.volces.com`. Additionally, the `how_to_send_video_via_feishu_app.md` document describes a `message` tool that reads a local `filePath` and uploads its content to `https://open.feishu.cn`, presenting another data exfiltration vector. The `seedance.py` script also uses `os.system(f'open "{filepath}"')` on macOS for downloaded videos, which could lead to arbitrary code execution if a malicious file URL is provided or injected. These are severe vulnerabilities, but the code does not show clear intent for self-exploitation or malicious behavior without external prompt manipulation.