Skill Tiktok Video Pipeline

End-to-end TikTok ad video pipeline. Product script → Veo base video → animated caption overlay → audio mix → final MP4. One command, full automation.

Security Scan

The skill mostly matches a TikTok video pipeline, but there are multiple mismatches and undeclared dependencies (missing env var declarations, references to other skills/scripts that don't exist in this package) that look like sloppy or incomplete wiring and warrant caution before installing or running.

Purpose & Capability

The name/description (end-to-end TikTok ad pipeline) aligns with the included scripts which orchestrate Veo/Runway video generation, overlay, and audio mixing. However the package expects other skills in the workspace (veo3-video-gen, runway/skill-runway-video-gen, and a different tiktok overlay skill name), which are not declared in metadata. That cross-skill dependency is plausible for a pipeline, but the references are inconsistent (different skill slugs and script names), suggesting copy-paste or packaging errors.

Instruction Scope

Runtime instructions and scripts run external commands (ffmpeg, ffprobe, 'uv run', bash -lc) and read/write workspace paths (WORKSPACE via ../../..). SKILL.md mentions GEMINI_API_KEY required for Veo generation but the registry metadata did not declare any required env vars. pipeline.py points at other skill directories and script names that are inconsistent with this package (e.g., 'skill-runway-video-gen', 'skill-tiktok-ads-video'), which may cause it to try to invoke arbitrary scripts elsewhere in the agent workspace if present. The instructions also forward the process environment to subprocesses, which could expose any env vars present at runtime to subprocesses.

Install Mechanism

No install spec (instruction-only) — nothing downloads or installs automatically. The provided code files are executed at runtime; risk comes from those runtime subprocesses rather than an install-time download. This is lower installation risk but still executes shell and 'uv run' commands when invoked.

Credentials

SKILL.md documents GEMINI_API_KEY and DEFAULT_AUDIO environment usage (DEFAULT_AUDIO fallback), but the registry shows no required env vars. The scripts propagate process.env into subprocesses and may cause secrets present in the agent environment to be visible to invoked commands. The number of env variables requested is small and consistent with a video-generation pipeline, but the omission from registry metadata is an incoherence and the forwarding of full env to subprocesses increases potential exposure.

Persistence & Privilege

The skill does not request always:true and is user-invocable only. It writes outputs into the workspace 'output/tiktok' and temporary dirs under workspace; it does not attempt to modify other skills or system configuration. Autonomous invocation is allowed by default (disable-model-invocation: false) but that is the platform default and not by itself a red flag.

What to consider before installing

This package appears to implement a TikTok video pipeline but has several inconsistencies you should resolve before running it: (1) SKILL.md and scripts expect an API key (GEMINI_API_KEY) but the registry metadata doesn't declare it — if you provide that key it will be sent to the Veo/Gen service when generating video. (2) The Node and Python orchestrators reference other skills and script paths that are inconsistent with the files included (veo3-video-gen, skill-runway-video-gen, skill-tiktok-ads-video). That means the pipeline may fail or attempt to run code from other folders in your workspace if present. (3) The scripts run shell commands ('bash -lc', ffmpeg, ffprobe, 'uv run') and forward the entire process environment to subprocesses, so avoid running this with sensitive credentials in your environment. Recommended steps before installing/running: run this in an isolated environment or container; inspect and, if necessary, correct the path references to the other skills or ensure the required helper skills are intentionally present; use the provided dry-run mode to test overlay behavior; do not run with sensitive env vars set (or sanitize env) until you confirm behavior; and review any external skills (veo/runway) that this orchestrator expects to call. Because of the mismatches and env handling, treat this as untrusted until you verify/correct those issues.

skill-tiktok-video-pipeline v2

Full end-to-end pipeline for TikTok product ads. Takes a product_id + script_text and outputs a publish-ready vertical short-form video with captions, optional logo watermark, and background music.

Architecture

script_text + product_id
       │
       ▼
Step 1: Veo 3 base video generation (9:16, ~8s)
       │
       ▼
Step 2: Caption overlay + logo watermark
        └── tiktok_overlay_engine_v3.py (ffmpeg drawtext)
       │
       ▼
Step 3: Background audio mix (20% volume, ffmpeg amix)
       │
       ▼
output/tiktok/<product_id>_<lang>_final.mp4

Requirements

• GEMINI_API_KEY env var (for Veo generation)
• ffmpeg on PATH
• uv on PATH (for Python scripts)
• veo3-video-gen skill installed at skills/veo3-video-gen/

Usage

node scripts/generate.js \
  --product-id rain_cloud \
  --script-text "Stop dry air!|Ultrasonic mist|Whisper-quiet|Get yours today" \
  --lang EN

With logo and custom audio

node scripts/generate.js \
  --product-id hydro_bottle \
  --script-text "Hydrogen water|Boosts energy|Pure & clean|Shop now" \
  --lang EN \
  --logo /path/to/brand_logo.png \
  --audio /path/to/bgm.mp3

Arabic (AR) captions

node scripts/generate.js \
  --product-id mini_cam \
  --script-text "صوّر كل لحظة|دقة عالية|خفيف وصغير|اطلب الآن" \
  --lang AR

Dry-run (no API calls, generates dummy video for testing overlay)

node scripts/generate.js \
  --product-id test \
  --script-text "Line 1|Line 2|Line 3" \
  --dry-run

Inputs

Argument	Required	Default	Description
--product-id	✅	—	Product identifier (used in output filename)
--script-text	✅	—	Caption lines separated by |
--lang	❌	EN	Language: EN or AR
--logo	❌	none	Path to logo PNG for watermark (top-right)
--audio	❌	assets/bgm_default.mp3	Background music path
--veo-model	❌	veo-3.1-generate-preview	Veo model to use
--prompt	❌	auto	Custom Veo generation prompt
--segments	❌	1	Number of Veo segments to generate & stitch
--dry-run	❌	false	Skip Veo API call; use dummy black video

Outputs

File	Description
output/tiktok/<product_id>_<lang>_final.mp4	Final publish-ready TikTok video

Scripts

Script	Description
scripts/generate.js	Main Node.js orchestrator
scripts/tiktok_overlay_engine_v3.py	Python/ffmpeg caption overlay engine

Caption Format

Captions are split by | and timed evenly across the video duration.

Example: "Hook line!|Feature 1|Feature 2|CTA here" → 4 pills, each shown for ~2s on an 8s video.

Pill style: dark semi-transparent box, white text, centered at 75% height.

Default Audio

Place a royalty-free BGM file at assets/bgm_default.mp3 in this skill folder to auto-mix audio in all runs. If no audio is found, the video is output without BGM.

Pipeline Steps Detail

Step 1  Veo 3 generates a 9:16 base MP4           ~60–120s
Step 2  Python overlays timed caption pills         ~5s
Step 3  ffmpeg mixes BGM at 20% volume              ~5s
─────────────────────────────────────────────────────────
Output  Final branded MP4 ready to post

pipeline.py (v2.0.0 — Python orchestrator)

Direct Python pipeline wired to overlay engine via subprocess.

uv run scripts/pipeline.py \
  --product rain_cloud \
  --image product.jpg \
  --output final.mp4 \
  --audio /path/to/music.mp3 \
  --slowmo

New flags (v2.0.0)

Flag	Default	Description
--audio	$DEFAULT_AUDIO env or bundled Hyperfun.mp3	Audio file passed to overlay step
--slowmo	false	Apply 0.83x speed → fills ~12s. Overrides --extend-to auto-stretch

Environment Variables

Var	Default	Description
DEFAULT_AUDIO	workspace root audio_Hyperfun.mp3	Default audio if --audio not set