Skip to content
skillsafebeta
← Report library
Purpose / Other

Seedance 2 5 Reference To Video Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Setup downloads and executes unpinned third-party npm software

Source references: 3
What we found

The prerequisites use a global npm install or `npx -y`, and the Skill installation command pins neither a version nor a commit. These operations can run package installation scripts and trust whatever code the registry or repository serves at execution time.

Why this matters

If a dependency, publisher account, or upstream repository is compromised, setup code could read files, access credentials, or persistently alter the development environment with the current user's permissions. A global installation also affects other projects.

The document directs installation and execution of tooling from npm or a Skill repository, while neither path pins a package version, tag, or commit; `npx -y` also accepts installation non-interactively. Execution therefore trusts third-party content published at that time. This supports an unpinned-code risk, but does not prove malicious install scripts exist. Users can require pinned artifacts, integrity locks, and package review.

SKILL.md:35In the instructionsOpen original file
```bashnpx skills add genmedia-labs/skills --skill seedance-2-5-reference-to-video -g```
Show 2 other places
SKILL.md:56In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli` (or `npx -y @runcomfy/cli`)2. **RunComfy account** — `runcomfy login` opens a browser device-code flow
SKILL.md:206In the instructionsOpen original file
- **Install via a verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe a remote install script into a shell** on the user's behalf.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. In CI set `RUNCOMFY_TOKEN`. Never echo the token into prompts, logs, or generated files.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Prompts and reference media are disclosed to a third-party service

Source references: 3
What we found

At runtime, the prompt and reference URLs are submitted to RunComfy, and its model server must be able to fetch the referenced files over the network. The Skill's “no exfiltration” wording does not change that these data leave the local environment for third-party processing.

Why this matters

Reference images, likenesses, voices, unreleased assets, and business information in prompts may enter a third-party processing environment. Hosting files so they are publicly reachable can also widen exposure.

Generation submits the prompt and user-selected reference URLs to RunComfy, and those URLs must be reachable by its model server. The source does not show automatic upload of local files; the disclosed scope is the prompt, URLs, and media the third party retrieves through them. Users should confirm hosting authorization and RunComfy's retention, training, and deletion policies.

SKILL.md:59In the instructionsOpen original file
3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`4. **Publicly reachable reference URLs** — the model server fetches them, not your machine
Show 2 other places
SKILL.md:202In the instructionsOpen original file
The skill builds a JSON body matching the schema above and runs `runcomfy run bytedance/seedance-2.5/reference-to-video/1080p`. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/bytedance/seedance-2.5/reference-to-video/1080p`, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` output URL into `--output-dir`.
SKILL.md:216In the instructionsOpen original file
- **Scope of bash usage**: declared `allowed-tools: Bash(runcomfy *)`. The skill never instructs the agent to run anything but `runcomfy <subcommand>`; the install line is one-time operator setup, not a per-call agent command.- **No data exfiltration.** Nothing the user shares leaves the conversation except the prompt and the reference URLs the user chose to send to the RunComfy Model API.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The installation command specifies no version, tag, or commit, so a later run may retrieve different Skill content from what was reviewed here. This is a reproducibility and supply-chain risk, not evidence that the repository is compromised. A user can ask for a pinned release or commit and a verification method.

SKILL.md:35In the instructionsOpen original file
```bashnpx skills add genmedia-labs/skills --skill seedance-2-5-reference-to-video -g```
Low risk

The RunComfy API token is persisted or supplied through an environment variable

Source references: 2
What we found

Browser login stores a token in the user's configuration directory, while CI uses an environment variable. Mode 0600 limits access by other local users, but same-account processes, malicious dependencies, or logs that capture environment variables could still obtain it.

Why this matters

A leaked token may let another party submit paid jobs against the user's account until the token is revoked or limits are exhausted.

The login flow persistently stores an API token in the user's configuration directory, while CI supplies it through an environment variable. Mode 0600 limits access by other local accounts, but the credential remains available to authorized local processes or CI jobs; the source does not show that it is leaked. Users can restrict process/job access, prevent environment logging, and use least-privilege, revocable tokens.

SKILL.md:57In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli` (or `npx -y @runcomfy/cli`)2. **RunComfy account** — `runcomfy login` opens a browser device-code flow3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`4. **Publicly reachable reference URLs** — the model server fetches them, not your machine
Show 1 other places
SKILL.md:207In the instructionsOpen original file
- **Install via a verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe a remote install script into a shell** on the user's behalf.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. In CI set `RUNCOMFY_TOKEN`. Never echo the token into prompts, logs, or generated files.- **Input boundary (shell injection)**: the prompt and every reference URL are passed as one JSON string via `--input`. The CLI does not shell-expand prompt content, so prompt text is not a shell-injection surface.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

The recommended workflow launches multiple per-second billed generations

Source references: 4
What we found

1080p billing counts reference-video duration plus output duration, while the workflow recommends three to five 480p variants followed by a 1080p final. No instruction requires explicit budget approval or a spending cap before submission.

Why this matters

Long references, multiple variants, and retries can accumulate charges; the documented examples reach $21.20 for a single job.

The Skill states that billing uses combined reference-video and output seconds, then recommends 3–5 draft generations followed by a 1080p generation. Each call can therefore incur charges. Although it gives price comparisons, it does not require budget approval or a hard spending cap before the batch. Users can limit call count, duration, and endpoint, and require confirmation of estimated cost per call.

SKILL.md:85In the instructionsOpen original file
Billing is **$0.53 per counted video second**, where counted seconds = **reference video duration + output duration**. Image and audio references are not billed as duration.
Show 3 other places
SKILL.md:92In the instructionsOpen original file
| 10 s output, one 6 s reference clip | 16 | $8.48 || 10 s output, three 10 s reference clips | 40 | $21.20 |
SKILL.md:155In the instructionsOpen original file
1. Assemble candidate references. Run 3-5 variants on `bytedance/seedance-2.5/reference-to-video/480p` at `duration: 5`.2. Judge identity hold, camera match, and audio fit — not sharpness.3. Re-run the winning body verbatim against `.../reference-to-video/1080p`, raising `duration` only once the beat is right.
SKILL.md:159In the instructionsOpen original file
At $0.12 per counted second on 480p versus $0.53 on 1080p, five drafts cost roughly what one 1080p final costs.
Low risk

The Skill contradicts itself about whether a reference video is required

Source references: 2
What we found

The input guidance explicitly says `videos` can be omitted and gives a lower resulting price, but the limitations section says the endpoint mandates one to three reference videos. A user cannot determine support for an image-only request from this Skill alone.

Why this matters

A no-video request may be rejected, or a user may add an unnecessary video—and billable duration—to satisfy the conflicting “mandatory” statement.

The same document first says `videos` may be omitted and that no-video requests complete, then says a reference video is mandatory. This direct conflict affects both request success and cost estimates. These lines alone cannot establish the current API rule; users can ask for the current official schema or a reproducible endpoint-version test.

SKILL.md:79In the instructionsOpen original file
**`videos` is optional, despite what the schema says.** The published input schema lists `videos` as required with a 1-item minimum, but the endpoint accepts and completes a prompt-plus-images body with no `videos` key at all. Send reference clips when you want camera motion and rhythm copied from an existing plate; omit them when your references are stills. Omitting them also drops the reference duration out of the billing: counted seconds fall back to output duration alone, so a 5 s clip costs $2.65 instead of $5.30.
Show 1 other places
SKILL.md:173In the instructionsOpen original file
- **A reference video is mandatory** on this endpoint (1-3 clips, 1-item minimum).- **1080p is fixed** — no resolution parameter, no 720p variant of this endpoint.

Inside this skill

8 instruction sections

The Skill uses the RunComfy CLI to send the prompt and user-selected reference-media URLs to the RunComfy Model API, poll job status, and download generated results to a chosen directory.

View source
SKILL.md:202In the instructionsOpen original file
The skill builds a JSON body matching the schema above and runs `runcomfy run bytedance/seedance-2.5/reference-to-video/1080p`. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/bytedance/seedance-2.5/reference-to-video/1080p`, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` output URL into `--output-dir`.

It accepts up to nine images, three videos, and three audio references; synchronized audio is enabled by default, duration is 4–30 seconds, and output is fixed at 1080p.

View source
SKILL.md:70In the instructionsOpen original file
| `prompt` | string | **yes** | — | Scene description that uses the references as cues. Chinese roughly 500 chars or English roughly 1000 words recommended. || `videos` | array (video URIs) | no | — | 0-3 reference clips for camera motion and rhythm. MP4/MOV, roughly 2-15 s each. Optional in practice — see below. || `images` | array (image URIs) | no | — | 0-9 reference images for identity, look, style, environment. JPEG/PNG/WebP/BMP/TIFF/GIF. || `audios` | array (audio URIs) | no | — | 0-3 reference audio for mood and pacing. WAV/MP3, roughly 2-15 s, under 15 MB. || `aspect_ratio` | enum | no | `16:9` | `16:9`, `9:16`, `1:1`, `4:3`, `3:4`, `21:9`, `adaptive`. || `duration` | int | no | `5` | 4-30 seconds, 1-second steps. || `generate_audio` | bool | no | `true` | Native synchronized speech, SFX, and music in the same pass. |
SKILL.md:77In the instructionsOpen original file
**Output resolution is fixed at 1080p** — there is no `resolution` field on this endpoint.

The declared agent tool permission covers only `runcomfy` commands; installation of the CLI and Skill is presented as a one-time operator setup step.

View source
SKILL.md:3In the instructionsOpen original file
name: seedance-2-5-reference-to-videoallowed-tools: Bash(runcomfy *)displayName: "Seedance 2.5 Reference to Video"
SKILL.md:215In the instructionsOpen original file
- **Generated-file size cap**: the CLI aborts any single download over 2 GiB.- **Scope of bash usage**: declared `allowed-tools: Bash(runcomfy *)`. The skill never instructs the agent to run anything but `runcomfy <subcommand>`; the install line is one-time operator setup, not a per-call agent command.- **No data exfiltration.** Nothing the user shares leaves the conversation except the prompt and the reference URLs the user chose to send to the RunComfy Model API.
Start here · InstructionsSKILL.md
seedance-2-5-reference-to-video
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 7 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:3In the instructionsOpen original file
name: seedance-2-5-reference-to-videoallowed-tools: Bash(runcomfy *)displayName: "Seedance 2.5 Reference to Video"
SKILL.md:34In the instructionsOpen original file
```bashnpx skills add genmedia-labs/skills --skill seedance-2-5-reference-to-video -g
SKILL.md:100In the instructionsOpen original file
```bashruncomfy run bytedance/seedance-2.5/reference-to-video/1080p \
Connect to websites
SKILL.md:22In the instructionsOpen original file
  explicit ask to generate video from reference images and clips.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:30In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-2-5-reference-to-video&utm_content=home) · [Seedance 2.5 Reference to Video 1080p](https://www.runcomfy.com/models/bytedance/seedance-2.5/reference-to-video/1080p?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-2-5-reference-to-video&utm_content=bytedance-seedance-2.5-reference-to-video-1080p) · [480p draft tier](https://www.runcomfy.com/models/bytedance/seedance-2.5/reference-to-video/480p?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-2-5-reference-to-video&utm_content=bytedance-seedance-2.5-reference-to-video-480p) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-2-5-reference-to-video&utm_content=cli-docs-introduction)
SKILL.md:47In the instructionsOpen original file
| Brand style locked by a moodboard, not described in prose | **Seedance 2.5 Reference to Video 1080p** (`images`) || Cheap iteration on which references actually work | [Seedance 2.5 Reference to Video 480p](https://www.runcomfy.com/models/bytedance/seedance-2.5/reference-to-video/480p?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-2-5-reference-to-video&utm_content=bytedance-seedance-2.5-reference-to-video-480p) || No references at all — prompt only | [Seedance 2.5 Text to Video 1080p](https://www.runcomfy.com/models/bytedance/seedance-2.5/text-to-video/1080p?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-2-5-reference-to-video&utm_cont …
Install extra software packages
SKILL.md:35In the instructionsOpen original file
```bashnpx skills add genmedia-labs/skills --skill seedance-2-5-reference-to-video -g```
SKILL.md:56In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli` (or `npx -y @runcomfy/cli`)2. **RunComfy account** — `runcomfy login` opens a browser device-code flow
SKILL.md:206In the instructionsOpen original file
- **Install via a verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe a remote install script into a shell** on the user's behalf.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. In CI set `RUNCOMFY_TOKEN`. Never echo the token into prompts, logs, or generated files.
Lines read
222
File checksum (to compare versions)
205db51ee409e3e2a4b7b6afd8ca726943e88494105ec3cc37b41d8cb93702ce