抖音生成短视频

This skill largely does what it says (generate scripts and call avatar/video provider APIs), but there are inconsistencies you should resolve before installing or providing API keys: - Confirm which environment variable the code actually uses: avatar-generator.js reads AVATAR_API_KEY. The SKILL.md lists HEYGEN_API_KEY, DID_API_KEY, and SYNTHESIA_API_KEY as well — that documentation may be outdated or misleading. Only give the minimum key required (preferably a provider-specific, scoped API key) and avoid pasting multiple unrelated credentials. - Because the source/homepage are unknown, review the avatar-generator.js implementation (it sends Bearer Authorization to provider endpoints) and verify the endpoints are correct for your provider. Prefer creating limited-scope API keys on the provider side. - The skill writes files under an output directory. Run it in a sandboxed directory or container if you want to limit filesystem impact. - If you rely on the skill to perform live web searches, note the current implementation uses a local stub for search (no live scraping). If you or someone adds network scraping/third-party search integrations later, re-audit those changes. - If you need higher assurance, ask the author for provenance (repository, homepage) or a signed release, or run the code in an isolated environment and inspect network traffic when generating a test job.