Security audit
Security checks across malware telemetry and agentic risk
This video-generation skill is mostly purpose-aligned, but it needs Review because it can upload sensitive voice/photo media, modify the Python environment, persist voice identifiers, and recursively delete output directories without strong controls.
Install only if you are comfortable with this skill uploading scripts, generated prompts, portrait photos, audio, and voice samples to platform.delilegal.com/OSS for cloud processing. Run it in a controlled environment with dependencies installed ahead of time, avoid sensitive or non-consented voice/photo material, review voice_config.json for stored API keys or voice IDs, and set the output path to a dedicated disposable directory because existing output directories are deleted.
import httpx # noqa: F811
return httpx
except ImportError:
subprocess.run(
[sys.executable, "-m", "pip", "install", "httpx", "certifi", "-q"],
check=True,
)except ImportError:
log("httpx 或 certifi 未安装，正在安装...", "WARN")
import subprocess
subprocess.run([sys.executable, "-m", "pip", "install", "httpx", "certifi", "-q"], check=True)
import httpx
import certifiimport certifi
import hashlib
except ImportError:
subprocess.run([sys.executable, "-m", "pip", "install", "requests", "certifi", "-q"], check=True)
import requests as _requests
import certifi
import hashlibimport edge_tts
except ImportError:
log("edge-tts 未安装，正在安装...", "WARN")
subprocess.run([sys.executable, "-m", "pip", "install", "edge-tts", "-q"], check=True)
import edge_tts
if gender == "male" and lang in EDGE_TTS_MALE_VOICES:from dashscope_api import generate_image as api_gen_image
import requests as _reqs
except ImportError:
subprocess.run([sys.executable, "-m", "pip", "install", "requests", "-q"], check=True)
import requests as _reqs
sys.path.insert(0, str(Path(__file__).parent))
from dashscope_api import generate_image as api_gen_imagetry:
from PIL import Image, ImageDraw, ImageFont
except ImportError:
subprocess.run([sys.executable, "-m", "pip", "install", "Pillow", "-q"], check=True)
from PIL import Image, ImageDraw, ImageFont
images = []put_headers["Content-Type"] = "application/octet-stream"
with open(local_path, "rb") as f:
file_data = f.read()
resp2 = _requests.put(upload_url, headers=put_headers, data=file_data, timeout=180)
if resp2.status_code not in (200, 204):
raise RuntimeError(f"[步骤二] 上传到 OSS 失败（{resp2.status_code}）：{resp2.text[:200]}")save_url = "https://platform.delilegal.com/api/v1/file/saveFile"
# 步骤一：获取上传临时链接
resp1 = _requests.post(
prepare_url,
headers=platform_headers,
json={"fileHash": file_hash, "fileName": file_name},raise RuntimeError(f"[步骤二] 上传到 OSS 失败（{resp2.status_code}）：{resp2.text[:200]}")
# 步骤三：保存文件记录
resp3 = _requests.post(
save_url,
headers=platform_headers,
json={"fileHash": file_hash, "originalName": file_name},output_path,
]
)
result = subprocess.run(cmd, capture_output=True)
if result.returncode != 0:
stderr = result.stderr.decode(errors='replace')
print(f"❌ 编码失败：{stderr[-500:]}")64/64 vendors flagged this skill as clean.