Skills seedance2-api
๐ฆ
seedance2-api
v1.1 Content revision r1 High Risk ๐ Network access๐ Env variablesโ๏ธ External commands
Generate Seedance 2.0 Videos from Storyboards
AI video workflows need clear prompts, assets, and status tracking. This skill guides storyboard planning and submits Seedance tasks through MCP or Python.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "seedance2-api" from https://skillstore.io/skills/hexiaochun-seedance2-api.md and its manifest at https://skillstore.io/api/skills/hexiaochun-seedance2-api/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "seedance2-api". Create a 10 second product reveal for a premium coffee cup.
Expected outcome:
- A timed storyboard with close-up steam, hand interaction, product rotation, and final brand frame.
- A reference image plan for cup material, morning light, and background setting.
- A task status summary with the generated media link when the video completes.
Using "seedance2-api". Make an astronaut walking on Mars in a cinematic style.
Expected outcome:
- A 15 second scene plan with camera movement, subject motion, atmosphere, and audio direction.
- Seedream reference image prompts for the astronaut and Martian environment.
- A Seedance task submission and polling update until completion or failure.
Using "seedance2-api". Extend this short clip by keeping the same character and motion style.
Expected outcome:
A continuation storyboard that preserves the original subject, movement, color tone, and pacing before submitting the new video task.
Security Audit
High Riskv4 โข 7/5/2026 Open versioned report
The skill performs expected third-party Seedance/XSkill API calls and uses an environment API key. Most Markdown backtick, task_id, and entropy findings are false positives, but the audit confirmed credential exposure guidance, bearer-token handling with a configurable base URL, unpinned package installation, and local file upload risk.
3
Files scanned
1,030
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (3)
High
API Key Prefix Disclosure Guidance
SKILL.md instructs the agent to verify XSKILL_API_KEY by printing the first ten characters. This can expose sensitive credential material in terminal output, logs, or shared transcripts.
The exact command prints part of the API key, and the line is an operational instruction rather than a harmless placeholder.
High
Configurable Base URL Can Redirect Bearer Token
scripts/seedance_api.py builds API endpoints from XSKILL_BASE_URL and sends XSKILL_API_KEY in the Authorization header. An untrusted base URL can receive the bearer token.
The code directly combines an environment-controlled base URL with a bearer Authorization header. Legitimate override use is possible, but the credential redirection path is clear.
Medium
Local File Upload Can Exfiltrate Arbitrary Paths
The upload command accepts --image-path, reads that local file, base64 encodes it, and posts it to the upload endpoint. A malicious prompt could request a sensitive path unless the agent confirms the file and type.
The file read and upload are explicit in the helper script. The risk depends on user or agent path choice, so medium severity is appropriate.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
"Authorization": f"Bearer {API_KEY}",
The Authorization header sends XSKILL_API_KEY as a bearer credential on outbound API calls. This is expected for authentication, but it is sensitive when combined with a configurable base URL.
High
Ruby/shell backtick execution
1. Verify `XSKILL_API_KEY` environment variable is set (run `echo $XSKILL_API_KEY | head -c 10`)
The setup instruction tells the agent to run echo $XSKILL_API_KEY | head -c 10, which prints part of a secret into terminal output. That can leak credential material into logs or transcripts.
High
Generic API/secret keys
1. Verify `XSKILL_API_KEY` environment variable is set (run `echo $XSKILL_API_KEY | head -c 10`)
The instruction includes echo $XSKILL_API_KEY | head -c 10, which exposes part of the API key. Even a prefix can be sensitive in logs and should not be printed.
Medium
Python environment access
BASE_URL = os.environ.get("XSKILL_BASE_URL", "https://api.xskill.ai")
The script trusts XSKILL_BASE_URL from the environment to build authenticated request URLs. If that variable is changed by an untrusted context, requests and bearer tokens can be redirected.
Medium
Ruby/shell backtick execution
3. Verify `requests` is installed (`pip install requests`)
The skill instructs users to run pip install requests, which performs network package installation without a pinned version. This is legitimate setup, but it introduces supply-chain and environment mutation risk.
Low
Python HTTP libraries
resp = requests.post(CREATE_URL, json=payload, headers=_headers(), timeout=30)
The helper makes authenticated HTTP requests to the XSkill API and may transmit prompts, task IDs, balance queries, or image data. This is expected for the skill but is real third-party network access.
Low
Python HTTP libraries
resp = requests.post(QUERY_URL, json={"task_id": args.task_id}, headers=_headers(), timeout=30)
The helper makes authenticated HTTP requests to the XSkill API and may transmit prompts, task IDs, balance queries, or image data. This is expected for the skill but is real third-party network access.
Low
Python HTTP libraries
resp = requests.post(QUERY_URL, json={"task_id": args.task_id}, headers=_headers(), timeout=30)
The helper makes authenticated HTTP requests to the XSkill API and may transmit prompts, task IDs, balance queries, or image data. This is expected for the skill but is real third-party network access.
Low
Python HTTP libraries
resp = requests.get(BALANCE_URL, headers=_headers(), timeout=30)
The helper makes authenticated HTTP requests to the XSkill API and may transmit prompts, task IDs, balance queries, or image data. This is expected for the skill but is real third-party network access.
Low
Python HTTP libraries
resp = requests.post(UPLOAD_URL, json=payload, headers=_headers(), timeout=60)
The helper makes authenticated HTTP requests to the XSkill API and may transmit prompts, task IDs, balance queries, or image data. This is expected for the skill but is real third-party network access.
Low
Hardcoded URL
BASE_URL = os.environ.get("XSKILL_BASE_URL", "https://api.xskill.ai")
The default API base points to an external service used for task creation, polling, balance checks, and uploads. This is expected, but it defines a real third-party data destination.
Low
Python environment access
API_KEY = os.environ.get("XSKILL_API_KEY", "")
The script reads XSKILL_API_KEY from the environment for API authentication. This is expected, but it handles a sensitive credential.
Risk Factors
๐ Network access (13)
๐ Env variables (10)
โ๏ธ External commands (70)
SKILL.md:20 SKILL.md:21 SKILL.md:26 SKILL.md:28-31 SKILL.md:31-32 SKILL.md:32 SKILL.md:34-35 SKILL.md:35-38 SKILL.md:38-51 SKILL.md:51 SKILL.md:67-76 SKILL.md:76-89 SKILL.md:89-90 SKILL.md:90-101 SKILL.md:101-105 SKILL.md:105-114 SKILL.md:114-115 SKILL.md:115-126 SKILL.md:126-130 SKILL.md:130-141 SKILL.md:141-144 SKILL.md:144-152 SKILL.md:152-155 SKILL.md:155-158 SKILL.md:158-161 SKILL.md:161-180 SKILL.md:180 SKILL.md:181-182 SKILL.md:182-186 SKILL.md:186-188 SKILL.md:188-190 SKILL.md:190 SKILL.md:204-211 SKILL.md:211-219 SKILL.md:219-228 SKILL.md:228-229 SKILL.md:229-232 SKILL.md:232-236 SKILL.md:236 SKILL.md:237 SKILL.md:238 SKILL.md:245-256 SKILL.md:256-265 SKILL.md:265-266 SKILL.md:266-269 SKILL.md:269-273 SKILL.md:273 SKILL.md:280-291 SKILL.md:291-304 SKILL.md:304-315 SKILL.md:315-318 SKILL.md:318-324 SKILL.md:324-327 SKILL.md:327-332 SKILL.md:332-333 SKILL.md:333-334 SKILL.md:334-335 SKILL.md:335-343 SKILL.md:343-354 SKILL.md:354-358 SKILL.md:358-380 SKILL.md:380-406 SKILL.md:406-419 SKILL.md:419-440 SKILL.md:440-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444 SKILL.md:446
Audited by: codex View Audit History โ
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/hexiaochun-seedance2-api/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/hexiaochun-seedance2-api?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/hexiaochun-seedance2-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/hexiaochun-seedance2-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/hexiaochun-seedance2-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA ยท BibTeX ยท CFF)
APA citation
hexiaochun. (2026). seedance2-api security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/hexiaochun-seedance2-api/audits/4BibTeX citation
@techreport{hexiaochun-hexiaochun-seedance2-api-2026,
author = {hexiaochun},
title = {seedance2-api security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/hexiaochun-seedance2-api/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "seedance2-api security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "hexiaochun"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/hexiaochun-seedance2-api/audits/4"
identifiers:
- type: other
value: "skillstore:hexiaochun-seedance2-api:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 59
Architecture
85
Maintainability
87
Content
70
Community
91
Spec Compliance
What You Can Build
Plan Short Social Videos
Turn a brief creative idea into a timed storyboard and Seedance prompt for a short AI video.
Create Product Motion Concepts
Draft product reveal scenes, reference images, and camera directions for fast visual exploration.
Automate Video Task Submission
Use MCP or the Python helper to submit tasks, poll status, and retrieve finished media links.
Try These Prompts
Basic Video Idea
Use seedance2-api to create a 6 second 16:9 video idea about a calm sunrise over a modern city. Build the storyboard and submit it if the API is ready.
Storyboard With Style
Create a 10 second vertical AI video storyboard for a new running shoe. Use energetic lighting, close product details, and a final brand reveal.
Reference Asset Workflow
Generate reference image prompts for a sci-fi explorer and alien desert scene, then use them to prepare a Seedance 2.0 video task.
Advanced Multimodal Task
Use my provided image, short motion reference, and audio reference to make a 15 second cinematic video. Keep references ordered and poll until the result is ready.
Best Practices
- Confirm duration, aspect ratio, visual style, and reference assets before submission.
- Use consistent names and ordering for image, video, and audio references.
- Review local file paths with the user before uploading any file.
Avoid
- Do not print API keys or partial API keys in terminal output.
- Do not submit vague prompts without timing, camera, motion, and asset details.
- Do not upload local files unless the user explicitly selected them for the video.
Frequently Asked Questions
Does this skill need an API key?
Yes. It needs XSKILL_API_KEY for task submission, polling, uploads, and balance checks.
Can it work without MCP tools?
Yes. It includes a Python helper script for submit, query, poll, balance, and upload commands.
What video lengths are supported?
The skill documents Seedance 2.0 durations from 4 to 15 seconds, depending on model parameters.
Can it use reference images?
Yes. It supports image references, first and last frames, and Seedream image generation workflows.
Does it store generated videos locally?
No. The helper prints API results and media URLs returned by the external service.
What should users check before uploading files?
Users should confirm the file path, file type, and that the image contains no sensitive content.
Developer Details
Author
hexiaochunLicense
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Ref
30c73eac2afe762f6aa9c4553158769369d47351
Maintenance freshness
7/18/2026
Usage
17 downloads ยท 225 views
File structure