Video Monetization Pro

Key things to consider before installing: 1) Missing / inconsistent credential list: SKILL.md and scripts reference Google API keys, a Suno verification URL, YouTube OAuth, and other platform logins but the registry metadata only lists SUNO_PHONE and KLING_* keys. Ask the author to provide a single, accurate list of required secrets and explain where each is used. 2) Embedded example credentials/tokens: The repository contains an API token/verification URL (sms8.net) and concrete phone numbers/emails in docs and demo files. Treat these as leaked test data — do not reuse them. Ask the author to remove all embedded tokens and replace with placeholders before installing. 3) Hardcoded absolute paths and fixed persona: Scripts default to /Users/huang/... and insist on a fixed performer asset path and Bilibili UID. That is inappropriate for general use and could cause accidental reads/writes on your machine. Request the author make paths configurable (relative to the skill workspace or use $HOME) and remove forced identity constraints. 4) Publishing and automation risks: The skill outlines automated publishing to multiple platforms and auto-sent daily reports. Do not provide platform credentials or OAuth tokens until you review the publish scripts line-by-line and test them in a sandbox. Confirm how credentials are stored and whether tokens are ever transmitted to third parties. 5) Local file modification: legal-check.sh edits input files in-place via sed. Back up files before running. Prefer that the script write reports to separate outputs rather than modifying originals. 6) Test in a sandbox: Run the scripts in an isolated VM/container with no real credentials and with OUTPUT_DIR pointed to a safe directory. Inspect network calls (e.g., with tcpdump) to see what endpoints are contacted when you run each script. 7) Request changes or refuse install if unresolved: Ask the maintainer to - remove embedded tokens and personal emails/phone numbers, - document exactly which credentials are required (and add them to metadata), - replace hardcoded paths with configurable variables defaulting to the skill workspace or $HOME, - provide a minimal-mode that runs only analysis/lyrics generation without publishing or external credentials. If the author cannot justify these issues or fix them, treat the package as untrusted and do not install with real credentials.