AI Short Video Script Generator Pro

This skill mostly does what it says, but there are several red flags you should consider before installing or running it: - Hard-coded secrets: The code includes embedded API keys (SkillPay and SiliconFlow) and a fixed Flask SECRET_KEY. These keys may be real and could be abused by whoever controls the endpoints. Prefer skills that require you to provide your own API keys via environment variables. - Data exfiltration / privacy: User inputs (topic, platform, duration) are sent to https://api.siliconflow.cn and billing calls go to https://skillpay.me. The SKILL.md does not clearly disclose this. If your prompts contain sensitive info, it will be transmitted to those third parties under the embedded keys. - Billing & costs: The skill charges per use via SkillPay.me. Confirm the billing provider is legitimate and that the hosted billing endpoint is what you expect. The code may redirect users to a payment URL returned by SkillPay. - Unsafe defaults: The main script runs Flask with debug=True and binds to 0.0.0.0 — this can expose an interactive debugger and enable remote code execution if the service is reachable. Do not run this in a networked or production environment without changing debug=False and binding to localhost or behind proper authentication. - Local persistence: Generated scripts are stored under data/scripts.db. If that matters for privacy or compliance, plan where the data is stored and who can access it. Recommendations before using/installing: 1. Review and remove hard-coded API keys. Replace them with environment variables and require the user to supply their own provider and billing credentials. 2. Set app.config['SECRET_KEY'] from an env var, and run Flask with debug=False and a safe host binding. 3. Audit the external endpoints (siliconflow.cn, skillpay.me) for legitimacy and privacy policy. Understand what data they log/retain. 4. If you cannot audit or control the keys and endpoints, avoid running the skill with real or sensitive prompts — treat it as untrusted remote execution. 5. If you decide to run it, consider running in an isolated environment (no public network exposure) and inspect network traffic to confirm behavior. Given the embedded secrets, external network calls, and unsafe debug setting, I classify this as suspicious rather than outright malicious — it may be sloppy/insecure engineering, but the inconsistencies materially increase risk.