Security audit
Security checks across malware telemetry and agentic risk
This video-clipping skill is mostly purpose-aligned, but it exposes a provider credential and sends transcript/title data to external AI services without clear user consent or scoping.
Review before installing. Use only videos whose subtitles and titles you are comfortable sending to MiniMax, do not rely on the embedded MiniMax key, and prefer a revised version that removes shared credentials, documents all third-party data flows, makes cover/LLM calls optional, and clarifies whether Tencent COS is actually used.
# 将字幕SRT转换为ASS格式（支持样式）
ass_file = output_path.replace(".mp4", ".ass")
cmd = ["ffmpeg", "-y", "-i", subtitle_file, ass_file]
subprocess.run(cmd, capture_output=True)
# 如果视频存在，直接裁剪；否则需要先下载
if video_downloaded and Path(video_downloaded).exists():"-threads", "2",
output_path
]
r = subprocess.run(cut_cmd, capture_output=True, text=True)
if r.returncode != 0:
# 字幕烧录失败，但视频已裁剪，输出无字幕版本
cut_cmd_no_sub = ["-c:a", "copy",
output_path
]
subprocess.run(cut_cmd_no_sub, capture_output=True)
return output_path65/65 vendors flagged this skill as clean.
No suspicious patterns detected.