Security checks across malware telemetry and agentic risk
This audio summarization skill does what it claims, but it needs review because it embeds a live-looking API key and runs ffmpeg through an unsafe shell command using the user’s file path.
Review before installing. Only run it on trusted filenames and non-sensitive media you are comfortable sending to Bailian/DashScope, replace the embedded API key with your own scoped secret, and prefer a version that invokes ffmpeg with subprocess arguments instead of a shell command.
print(f"正在从视频提取音频并极致压缩: {video_path}")
# 压缩为 16k mono mp3, 32k 码率以确保 Base64 编码后不超过 10MB (约支持 10-15 分钟视频)
cmd = f'ffmpeg -y -i "{video_path}" -vn -ar 16000 -ac 1 -ab 32k "{audio_path}" -loglevel error'
os.system(cmd)
return os.path.exists(audio_path)
def transcribe_with_data_uri(audio_path):63/63 vendors flagged this skill as clean.