SECURITY.md

Security Policy

Scope

Seedance 2.0 Skill OS is an offline agent-skill and reference package: Markdown skill/reference files plus deterministic local Python validation scripts. It is not a hosted service, an API wrapper, or a runtime that executes on its own. It stores no credentials and ships no telemetry.

One script in the repository is an exception and is called out below: scripts/eval_run.py is a development-only evaluator that contacts a model provider and reads a credential from the environment. It is excluded from the installed payload, and tests/test_install_payload.py fails if it — or anything else able to open a socket or read a credential — reaches an install.

Reporting a vulnerability

Please report suspected vulnerabilities privately rather than in a public issue:

• Use GitHub's private vulnerability reporting on this repository (the Security tab → Report a vulnerability).

Include what you found, where, and how to reproduce it. We aim to acknowledge reports within a reasonable time and will credit reporters who want it once a fix ships.

Security posture of this package

• No telemetry, and no network calls from anything you install. The skill content is text. Every script the CI gate runs is a deterministic, offline validator that needs no credentials — read them before running.
• One development-only exception, and it is live by default. scripts/eval_run.py sends eval prompts to the endpoint selected by --provider and --region, then reads that provider's API key from the environment (ANTHROPIC_API_KEY or MINIMAX_API_KEY). Running it with no arguments performs live calls; --self-test is the offline wiring check, and it is the only mode CI runs. It honours HTTPS_PROXY and SSL_CERT_FILE.
• The installed payload is offline by construction, not by convention. scripts/install_codex_skill.py excludes the evaluator and the test suite, and nothing in skills/ or references/ invokes either, so installing this skill cannot cause a network call. tests/test_install_payload.py parses every Python file in a real install and fails if any imports a network module or reads a credential-shaped environment name, so the guarantee is checked rather than asserted.
• Evaluator output carries model-derived text. A live run prints each case's verdict to the console and, with --ledger, writes a table of scores plus truncated judge notes. Full prompts and full model responses stay in memory and are never written to disk, but the notes are model output. The credential is never serialised: it travels in a request header and is written nowhere. The tracked ledger at evals/eval-run-ledger.md is committed deliberately and holds only scores and notes; --ledger otherwise writes to whatever path you name, and Git will not stop you committing it. eval-runs/ is ignored as a safe place for ad-hoc runs — use it, and read any ledger before sharing one.
• No secrets in the repo. API keys, account cookies, and private prompt corpora are never stored here (see references/agent-compatibility.md). Do not add them in a fork or PR.
• CI validates structure, not just prose. Every push and pull request runs the ordinary, unprivileged checks in .github/workflows/validate-skills.yml. In the checked-in revision, Linux metadata-preservation success cases live in .github/workflows/privileged-frame-publication.yml, whose trigger allowlist is only push plus explicit workflow_dispatch; it has no pull-request-derived trigger and persists no checkout credential. That workflow does not infer privilege from UID 0 or --privileged: it proves effective CAP_SYS_ADMIN, descriptor-bound extended-attribute APIs, atomic exchange support, and the filesystem contract first. If a hosted runner withholds any prerequisite, the workflow verifies that force replacement fails closed, emits an explicit skip notice naming the unavailable contract pieces, and does not claim the success-path regressions ran. That file-level trigger surface is not an immutable guarantee: a fork can propose changing workflow YAML. Repository administrators must configure GitHub Actions to require approval for all outside collaborators, and approvers must inspect every .github/workflows/** change before allowing a fork run. The weaker first-time-contributor policy permits an established outside contributor to run a modified workflow without a fresh approval. If the all-outsider gate cannot be enforced, disable fork workflow execution rather than treating this trigger list as a sandbox. See GitHub's fork-run approval guidance and workflow/ref model. Fork PRs against this unchanged revision receive the complete ordinary validation and fail-closed Linux coverage, but the project does not claim that repository content alone can make future workflow edits safe.
• Dependency bootstrap is provenance-bound. CI itself is not an egress sandbox: checkout, setup, caching, and the explicit dependency download can contact their services, but checkout removes its persisted credential before repository code runs. Both wheel locks reject URL, include, and index directives and require --only-binary=:all:; downloads repeat that binary-only rule. Pip installation removes inherited PIP_*, Python, virtualenv, and native-loader overrides, disables configuration through /dev/null, and uses --no-index against the hash-verified wheelhouse. A newly cleared, run-attempt-specific venv is accepted only after guarded path checks and an external checkout-keyed trust record bind the trusted Python, stdlib launcher, copied runner, configuration, builder, lock, and marker. The retained wheels, pip report, and every installed locked-distribution file are then sealed, and installed imports must match the retained wheel bytes. Public masthead commands, including python -I -S -B scripts/build_hero.py --check, run with isolated startup and require the structured seal-bound record. The schema validator likewise refuses external or unresolved references, including invalid schemas reached through local pointers or anchors, while respecting nested Draft 2020-12 $id resource scopes. The checked-in validation phase is offline by design, not an operating-system network boundary.
• Frame-output publication has an OS trust boundary. Windows retains the non-reparse destination directory and creates its exclusively opened stage before decode, so a parent rename/recreation or ancestor-junction retarget cannot redirect either no-replace publication or cleanup. The native publication boundary independently rejects Win32 device stems, including COM¹/COM²/COM³ and LPT¹/LPT²/LPT³, and uses extended-length paths for valid near-limit basenames. Windows --force opens and retains the old target, compares its owner/group/DACL/mandatory-label descriptor to the protected stage, and initially refuses named streams or policy-bearing attributes. Commit uses ReplaceFileW without metadata-ignore flags and a unique rollback backup of the actual boundary-time target. Before that backup is deleted, the helper verifies the displaced identity, bytes, security policy, streams, and attributes and verifies the published stage on the same axes; owner, group, ordered ACL entries, ACL control flags, and mandatory label are compared as canonical SDDL instead of provider-specific self-relative offsets or padding. A mismatch preserves the rejected inode with a hard link, restores the exact backup by handle, and only then deletes the rejected generated file. A failed native call promotes a rollback pathname only when its complete state matches the audited target; an untrusted preclaim is preserved as a recovery artifact and never overwrites the destination. Console reporting remains non-transactional after publication. Linux with procfs links /proc/self/fd/<fd>, binding publication to the verified open staging inode even if its name is replaced. Other POSIX systems, and minimal Linux environments without procfs, fall back to a verified 0700 private staging directory: this excludes writers from other accounts, but cannot promise isolation from a hostile process running under the same Unix account, which shares the owner's directory permissions. Linux --force additionally requires an output directory owned by the effective user and not writable by group or others. Before decoding, it opens and retains the existing target, snapshots descriptor-readable user attributes and Linux access ACLs alongside owner/group/mode, proves effective CAP_SYS_ADMIN, tests trusted.* visibility, and probes renameat2(RENAME_EXCHANGE) on the actual filesystem. At publication it rechecks the bound target, atomically exchanges the staged and destination entries, verifies both sides, and either commits deletion of the exact displaced inode or exchanges back so a target swapped after verification is restored. If any capability, visibility, enumeration, metadata, directory-control, exchange, or rollback proof fails—or inspection exposes a security, trusted, or unsupported system policy attribute—replacement is refused. Other POSIX runtimes refuse --force. Every retained PNG must also pass a bounded independent FFmpeg decode before any platform publishes it. In ordinary unprivileged Linux use, choose a new output name instead; creating a new output needs no capability.

Using this skill safely inside an agent

This package is only as safe as the agent client you load it into. The skill itself does nothing on its own; the agent that reads it can do whatever that agent is allowed to do. Treat the agent — not this skill — as your trust boundary.

• Install only into agent clients you trust and keep them updated. Do not install into unknown or unvetted agents just because they accept the skill format.
• Never paste secrets into an untrusted agent. This skill never asks for API keys, tokens, account cookies, or private/client footage. If an agent — or a modified copy of this skill — asks for them, stop.
• Prefer clients that sandbox or scan skills on install (for example, Hermes runs a security scan on hermes skills install). Verify install paths in your own client; the cross-agent matrix in references/agent-compatibility.md is labeled "verify in your client," not a guarantee.
• Review before you load. Any skill from any source is Markdown that an agent will read as instructions. Review third-party skills — including forks of this one — before loading them into a privileged agent; prompt-injection-style text can hide in innocent-looking docs.
• Keep the content boundaries. The seedance-copyright and seedance-filter skills rewrite unsafe requests into safe, original equivalents and repair false-positive filtering by clarifying legitimate production context. They are not tools to defeat any platform's safety systems — do not use this package to evade provider moderation.

What this project will not do

• It will not add telemetry, network calls, or credential prompts to the installable skill. Repository validators run offline after the separately identified CI dependency bootstrap. Development-only network tools must stay excluded from the package, explicit about when they transmit, and documented here.
• It will not claim that every agent client can install directly from the repository URL, or that any registry lists this skill unless it has actually been published there.