Seedance Video Generation Extension

Orchestrate script-to-final-video production with a strict stage-gated workflow (outline → episode_plan → storyboard → storyboard_images → render), using See...

What to check before installing/use: - Metadata mismatch: the registry entry lists no required env vars, but SKILL.md and scripts require ARK_API_KEY (Seedream) and expect seedance.py from a separate skill. Treat the package as incomplete until the registry metadata is corrected. - Credential scope: only provide an ARK_API_KEY that is limited in scope (image-generation only) and rotatable. Do not reuse high-privilege or unrelated credentials. - External endpoint: image requests go to https://ark.cn-beijing.volces.com/api/v3/images/generations. Verify this endpoint and the operator before sending any private prompts or data. - Subprocess and downloads: scripts call seedance.py and run/parse its JSON output, and download URLs returned by remote services. Run in a sandbox or with least-privilege access to the filesystem, and review seedance-video-generation's source (seedance.py) before granting runtime access. - Audit artifacts: the workflow writes checkpoint-*.json and output videos/images under the project directory; ensure project paths used are intended and do not point to sensitive directories. - If you need higher assurance: ask the publisher to (1) update registry metadata to declare ARK_API_KEY and any other env vars, (2) provide a homepage/source repository for review, and (3) document the external API operator and expected token permissions.

Type: OpenClaw Skill Name: seedance-story-orchestrator Version: 1.0.0 The skill is classified as suspicious primarily due to the `download_video` function in `scripts/orchestrate_story.py`. This function uses `urllib.request.urlretrieve` to download files from URLs provided by the `seedance.py` sub-skill's output. While intended for legitimate video downloads, this capability introduces a vulnerability: if the `seedance.py` dependency or its output were compromised, it could be leveraged to download arbitrary malicious payloads or exfiltrate data to external endpoints. Additionally, `scripts/seedream_image.py` directly accesses the `ARK_API_KEY` environment variable, which is a sensitive capability, though necessary for its stated purpose. There is no clear evidence of intentional malicious behavior such as credential theft or backdoor installation within this skill bundle; rather, these are risky capabilities that could be exploited.