Skills seedance-2-5-reference-to-video

📦

seedance-2-5-reference-to-video

Name: seedance-2-5-reference-to-video
Author: genmedia-labs

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Generate Reference-Guided Seedance 2.5 Videos

Keeping characters, products, and visual style consistent across generated video is difficult. This skill builds and runs reference-guided Seedance 2.5 requests through RunComfy.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "seedance-2-5-reference-to-video" from https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video.md and its manifest at https://skillstore.io/api/skills/genmedia-labs-seedance-2-5-reference-to-video/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/genmedia-labs-seedance-2-5-reference-to-video.md Signed manifest GET /api/skills/genmedia-labs-seedance-2-5-reference-to-video/manifest Signed lockfile GET /api/skills/genmedia-labs-seedance-2-5-reference-to-video/lockfile

Test it

Using "seedance-2-5-reference-to-video". Three portrait references, one four-second handheld clip, an eight-second vertical output, and quiet street ambience.

Expected outcome:

Prepared an eight-second vertical character shot using the portraits for identity and the clip for camera rhythm. Estimated counted duration: 12 seconds.

Using "seedance-2-5-reference-to-video". Product front and side images, a turntable motion reference, and a clean studio background.

Expected outcome:

Prepared a product-focused 1080p request with preserved geometry, matched turntable motion, controlled studio lighting, and no text.

Using "seedance-2-5-reference-to-video". A moodboard and two candidate movement clips for a five-second brand video.

Expected outcome:

Recommended separate 480p tests for each movement clip before selecting one reference stack for the final 1080p generation.

Security Audit

High Risk

v1 • 9/5/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks, links, example domains, and an abbreviated endpoint. Confirmed behavior includes package execution, scoped RunComfy commands, authentication, remote API traffic, and output downloads. User-controlled values embedded in single-quoted shell input create a high-confidence shell injection risk.

Files scanned

222

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:100-125 SKILL.md:202-208

Shell Injection Risk in Constructed CLI Input

The skill builds a shell command containing user-controlled prompt text and URLs inside a single-quoted JSON argument. An apostrophe or crafted value can terminate shell quoting before the CLI receives the data.

The examples use single-quoted inline JSON, and the skill states that it builds this body from prompt and reference values. The shell parses quoting before RunComfy can prevent expansion.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:16-17

Ruby/shell backtick execution

Pro instead. Calls `runcomfy run

The description states that the skill calls the runcomfy executable. This is intended functionality, but it is real external command execution.

Medium

SKILL.md:34-36

Ruby/shell backtick execution

```bash

The fenced block contains an npx command that installs this skill globally. Running an npm-hosted executable creates a supply-chain and local-change risk.

Medium

SKILL.md:56

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli` (or `npx -y @runcomfy/cli`)

This prerequisite directs users to install or execute the RunComfy CLI through npm or npx. Package execution is real external command activity.

Medium

SKILL.md:57-58

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow

The instruction runs runcomfy login and starts an authentication flow. It is legitimate, but it executes an external program and creates credentials.

Medium

SKILL.md:100-107

Ruby/shell backtick execution

```bash

This fenced example invokes runcomfy with input data and an output directory. The command performs a paid remote job and writes downloaded output.

Medium

SKILL.md:111-125

Ruby/shell backtick execution

```bash

This fenced example invokes runcomfy with reference URLs, prompt text, and an output directory. It is genuine external command execution.

Medium

SKILL.md:202

Ruby/shell backtick execution

The skill builds a JSON body matching the schema above and runs `runcomfy run bytedance/seedance-2.5

The skill explicitly says it builds input and runs the runcomfy executable. This confirms external command execution as part of normal operation.

Medium

SKILL.md:206

Ruby/shell backtick execution

- **Install via a verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy

This line instructs installation or execution of the RunComfy package through npm or npx. The commands are operator setup, but still carry package supply-chain risk.

Medium

SKILL.md:207

Ruby/shell backtick execution

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The documented runcomfy login command executes the CLI and writes an authentication token. This is expected authentication behavior with security impact.

Medium

SKILL.md:215

Ruby/shell backtick execution

- **Scope of bash usage**: declared `allowed-tools: Bash(runcomfy *)`. The skill never instructs the

The declared Bash(runcomfy *) permission authorizes external CLI execution. Its scope is narrow, but the command capability is real.

Medium

SKILL.md:202

Hardcoded URL

The skill builds a JSON body matching the schema above and runs `runcomfy run bytedance/seedance-2.5

The line explicitly documents a POST to the RunComfy Model API and subsequent remote downloads. This is required service traffic, but it sends user-selected data externally.

Risk Factors

⚙️ External commands (50)

🌐 Network access (22)

📁 Filesystem access (3)

SKILL.md:157 SKILL.md:207 SKILL.md:207

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/genmedia-labs-seedance-2-5-reference-to-video/security.svg)](https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/genmedia-labs-seedance-2-5-reference-to-video/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/genmedia-labs-seedance-2-5-reference-to-video.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

genmedia-labs. (2026). seedance-2-5-reference-to-video security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1

BibTeX citation

@techreport{genmedia-labs-genmedia-labs-seedance-2-5-reference-to-video-2026,
  author = {genmedia-labs},
  title = {seedance-2-5-reference-to-video security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "seedance-2-5-reference-to-video security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "genmedia-labs"
date-released: "2026-09-05"
url: "https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1"
identifiers:
  - type: other
    value: "skillstore:genmedia-labs-seedance-2-5-reference-to-video:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Maintain Character Identity

Generate several shots that preserve a person's face, wardrobe, and visual treatment from supplied images.

Create Product Motion Clips

Combine product stills with a short motion reference to produce consistent promotional footage.

Prototype Social Video

Test references at 480p, select the best result, then render a vertical 1080p version.

Try These Prompts

Create a Basic Clip

Create a 5-second 16:9 video from [reference URL]. Show [subject] performing [action] with [lighting]. Do not add text or watermarks.

Preserve a Character

Use these identity and wardrobe images: [URLs]. Create an 8-second 9:16 shot where [character action]. Keep face, clothing, and colors consistent.

Match Product Motion

Use [product image URLs] for geometry and [video URL] for camera motion. Generate a 6-second product shot with [background], [lighting], and [sound].

Plan a Reference Stack

Review these image, video, and audio references: [URLs]. Recommend a 480p test plan, estimate counted seconds, then request approval before the 1080p render.

Best Practices

Use images for stable identity, geometry, wardrobe, and brand colors.
Trim video references to the shortest segment that demonstrates the desired motion.
Test reference combinations at 480p before approving a 1080p render.

Avoid

Do not combine unrelated visual styles in one reference stack.
Do not reuse Seedance 2.0 field names for this endpoint.
Do not submit sensitive references without reviewing the external service and destination.

Frequently Asked Questions

What does this skill generate?

It generates reference-guided 1080p Seedance 2.5 videos through RunComfy.

Which reference types are supported?

The documented request supports images, video clips, and audio files through publicly reachable URLs.

How long can the output be?

The output can be 4-30 seconds in whole-second steps.

How is usage priced?

The documented 1080p rate is based on output duration plus total reference-video duration. Confirm current pricing before submission.

Can it reproduce the exact same result?

No seed parameter is documented, so exact reproduction between calls is not guaranteed.

Where are generated files saved?

The RunComfy CLI downloads completed files into the output directory chosen for the command.

Developer Details

Author

genmedia-labs

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/genmedia-labs/skills/tree/4dc788aecbefc99cb188cc43c4ce08383d33f768/seedance-2-5-reference-to-video

Ref

e5464e662405de6361fdde6b984f9ea865635f64

Maintenance freshness

9/8/2026

Usage

0 downloads · 0 views

File structure

📄 SKILL.md