Seedance Video Generation BytePlus

Generate AI videos using BytePlus Seedance API (International). Use when the user wants to: (1) generate videos from text prompts, (2) generate videos from images (first frame, first+last frame, reference images), or (3) query/manage video generation tasks. Supports Seedance 1.5 Pro (with audio & draft mode), 1.0 Pro, 1.0 Pro Fast, and 1.0 Lite models.

This package mostly does what it claims (calls BytePlus/Seedance to create and poll video generation tasks), but pay attention to the following before installing: - Manifest mismatch: The code and SKILL.md require ARK_API_KEY, but the skill registry metadata lists no required environment variables. Treat ARK_API_KEY as required and ensure you only provide a BytePlus key with appropriate, limited permissions and billing awareness. - Optional Feishu flow: The bundle contains a guide to upload generated videos to Feishu that reads local files and uses Feishu app credentials (app_id / app_secret / app_access_token) stored in OpenClaw settings; those credentials are not declared in the manifest. If you plan to use the Feishu integration, verify the message tool and Feishu app settings separately and understand that files under your workspace will be uploaded to Feishu/CDN. - Local file access: The CLI converts local images to base64 and downloads generated videos to user-specified paths (e.g., ~/.claude/skills or workspace). Make sure sensitive images/videos are not placed in those locations if you don’t want them uploaded. - Network calls & billing: The tool makes outbound HTTP requests to the BytePlus Ark API (BASE_URL = https://ark.ap-southeast.bytepluses.com). Generating videos may incur cost — confirm your BytePlus account/billing and rate limits. - Source review: The Python code is included; if you will run it, consider inspecting the file yourself or running it in an isolated environment. There are no pre-scan injection flags, but the manifest inconsistency (undeclared env vars) lowers trust until corrected. If you want higher assurance, ask the skill author or registry maintainer to (1) update the skill manifest to declare ARK_API_KEY as required, (2) explicitly document optional Feishu credentials (or move the Feishu guide to a separate integration package), and (3) provide an official homepage/source URL so you can verify origin and updates.

Type: OpenClaw Skill Name: seedance-video-generation-byteplus Version: 1.0.1 The skill is designed for a legitimate purpose (AI video generation via BytePlus API) and communicates with a legitimate endpoint. However, the `seedance_byteplus.py` script's `image_to_data_url` function, used for image-to-video functionality, can read arbitrary local files (if provided a path via prompt injection) and base64 encode their content for transmission to the BytePlus API. While the code's intent is to process image files, this capability creates a local file disclosure vulnerability, as a malicious prompt could trick the agent into sending sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) to the third-party API. Additionally, the `os.system` call to open downloaded videos in `cmd_wait_logic` presents a minor shell injection risk, although the filepath construction makes direct exploitation difficult. These risky capabilities, without clear malicious intent by the skill developer, classify it as suspicious.