技能 seedance-2-5-reference-to-video
📦
seedance-2-5-reference-to-video
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
Generate Reference-Guided Seedance 2.5 Videos
Keeping characters, products, and visual style consistent across generated video is difficult. This skill builds and runs reference-guided Seedance 2.5 requests through RunComfy.
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "seedance-2-5-reference-to-video" from https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video.md and its manifest at https://skillstore.io/api/skills/genmedia-labs-seedance-2-5-reference-to-video/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「seedance-2-5-reference-to-video」。 Three portrait references, one four-second handheld clip, an eight-second vertical output, and quiet street ambience.
預期結果:
Prepared an eight-second vertical character shot using the portraits for identity and the clip for camera rhythm. Estimated counted duration: 12 seconds.
正在使用「seedance-2-5-reference-to-video」。 Product front and side images, a turntable motion reference, and a clean studio background.
預期結果:
Prepared a product-focused 1080p request with preserved geometry, matched turntable motion, controlled studio lighting, and no text.
正在使用「seedance-2-5-reference-to-video」。 A moodboard and two candidate movement clips for a five-second brand video.
預期結果:
Recommended separate 480p tests for each movement clip before selecting one reference stack for the final 1080p generation.
安全審計
高風險v1 • 2026/9/5 開啟版本化報告
Most static findings are false positives caused by Markdown backticks, links, example domains, and an abbreviated endpoint. Confirmed behavior includes package execution, scoped RunComfy commands, authentication, remote API traffic, and output downloads. User-controlled values embedded in single-quoted shell input create a high-confidence shell injection risk.
1
已掃描檔案
222
分析行數
11
複核項目
0
已忽略的誤報
已確認的安全問題 (1)
高
Shell Injection Risk in Constructed CLI Input
The skill builds a shell command containing user-controlled prompt text and URLs inside a single-quoted JSON argument. An apostrophe or crafted value can terminate shell quoting before the CLI receives the data.
The examples use single-quoted inline JSON, and the skill states that it builds this body from prompt and reference values. The shell parses quoting before RunComfy can prevent expansion.
能力複核項目 (11)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
Ruby/shell backtick execution
Pro instead. Calls `runcomfy run
The description states that the skill calls the runcomfy executable. This is intended functionality, but it is real external command execution.
中
Ruby/shell backtick execution
```bash
The fenced block contains an npx command that installs this skill globally. Running an npm-hosted executable creates a supply-chain and local-change risk.
中
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli` (or `npx -y @runcomfy/cli`)
This prerequisite directs users to install or execute the RunComfy CLI through npm or npx. Package execution is real external command activity.
中
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow
The instruction runs runcomfy login and starts an authentication flow. It is legitimate, but it executes an external program and creates credentials.
中
Ruby/shell backtick execution
```bash
This fenced example invokes runcomfy with input data and an output directory. The command performs a paid remote job and writes downloaded output.
中
Ruby/shell backtick execution
```bash
This fenced example invokes runcomfy with reference URLs, prompt text, and an output directory. It is genuine external command execution.
中
Ruby/shell backtick execution
The skill builds a JSON body matching the schema above and runs `runcomfy run bytedance/seedance-2.5
The skill explicitly says it builds input and runs the runcomfy executable. This confirms external command execution as part of normal operation.
中
Ruby/shell backtick execution
- **Install via a verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy
This line instructs installation or execution of the RunComfy package through npm or npx. The commands are operator setup, but still carry package supply-chain risk.
中
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The documented runcomfy login command executes the CLI and writes an authentication token. This is expected authentication behavior with security impact.
中
Ruby/shell backtick execution
- **Scope of bash usage**: declared `allowed-tools: Bash(runcomfy *)`. The skill never instructs the
The declared Bash(runcomfy *) permission authorizes external CLI execution. Its scope is narrow, but the command capability is real.
中
Hardcoded URL
The skill builds a JSON body matching the schema above and runs `runcomfy run bytedance/seedance-2.5
The line explicitly documents a POST to the RunComfy Model API and subsequent remote downloads. This is required service traffic, but it sends user-selected data externally.
風險因素
⚙️ 外部命令 (50)
SKILL.md:7 SKILL.md:16-17 SKILL.md:34-36 SKILL.md:36-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-56 SKILL.md:56 SKILL.md:57-58 SKILL.md:58 SKILL.md:61-65 SKILL.md:65-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:77-79 SKILL.md:79 SKILL.md:81 SKILL.md:100-107 SKILL.md:107-111 SKILL.md:111-125 SKILL.md:125-127 SKILL.md:127 SKILL.md:129 SKILL.md:133 SKILL.md:135-139 SKILL.md:139-143 SKILL.md:143 SKILL.md:149 SKILL.md:155 SKILL.md:157 SKILL.md:167-169 SKILL.md:169-182 SKILL.md:182-183 SKILL.md:183 SKILL.md:185 SKILL.md:193 SKILL.md:202 SKILL.md:206 SKILL.md:207 SKILL.md:208-213 SKILL.md:213 SKILL.md:215 SKILL.md:220 SKILL.md:221-222 SKILL.md:222
🌐 網路存取 (22)
📁 檔案系統存取 (3)
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/genmedia-labs-seedance-2-5-reference-to-video/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/genmedia-labs-seedance-2-5-reference-to-video.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
genmedia-labs. (2026). seedance-2-5-reference-to-video security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1BibTeX 引用
@techreport{genmedia-labs-genmedia-labs-seedance-2-5-reference-to-video-2026,
author = {genmedia-labs},
title = {seedance-2-5-reference-to-video security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "seedance-2-5-reference-to-video security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "genmedia-labs"
date-released: "2026-09-05"
url: "https://skillstore.io/skills/genmedia-labs-seedance-2-5-reference-to-video/audits/1"
identifiers:
- type: other
value: "skillstore:genmedia-labs-seedance-2-5-reference-to-video:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
65
社群
83
規範符合度
你可以打造什麼
Maintain Character Identity
Generate several shots that preserve a person's face, wardrobe, and visual treatment from supplied images.
Create Product Motion Clips
Combine product stills with a short motion reference to produce consistent promotional footage.
Prototype Social Video
Test references at 480p, select the best result, then render a vertical 1080p version.
試試這些提示
Create a Basic Clip
Create a 5-second 16:9 video from [reference URL]. Show [subject] performing [action] with [lighting]. Do not add text or watermarks.
Preserve a Character
Use these identity and wardrobe images: [URLs]. Create an 8-second 9:16 shot where [character action]. Keep face, clothing, and colors consistent.
Match Product Motion
Use [product image URLs] for geometry and [video URL] for camera motion. Generate a 6-second product shot with [background], [lighting], and [sound].
Plan a Reference Stack
Review these image, video, and audio references: [URLs]. Recommend a 480p test plan, estimate counted seconds, then request approval before the 1080p render.
最佳實務
- Use images for stable identity, geometry, wardrobe, and brand colors.
- Trim video references to the shortest segment that demonstrates the desired motion.
- Test reference combinations at 480p before approving a 1080p render.
避免
- Do not combine unrelated visual styles in one reference stack.
- Do not reuse Seedance 2.0 field names for this endpoint.
- Do not submit sensitive references without reviewing the external service and destination.
常見問題
What does this skill generate?
It generates reference-guided 1080p Seedance 2.5 videos through RunComfy.
Which reference types are supported?
The documented request supports images, video clips, and audio files through publicly reachable URLs.
How long can the output be?
The output can be 4-30 seconds in whole-second steps.
How is usage priced?
The documented 1080p rate is based on output duration plus total reference-video duration. Confirm current pricing before submission.
Can it reproduce the exact same result?
No seed parameter is documented, so exact reproduction between calls is not guaranteed.
Where are generated files saved?
The RunComfy CLI downloads completed files into the output directory chosen for the command.
開發者詳細資訊
授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
e5464e662405de6361fdde6b984f9ea865635f64
維護新鮮度
2026/9/8
使用量
1 次下載 · 0 次瀏覽
檔案結構
📄 SKILL.md