Security audit
Security checks for vulnerabilities and agentic risk
This is a real video-analysis skill, but it makes misleading offline claims while performing default and optional network actions, including remote downloads with TLS checks disabled.
Install only if you are comfortable with a media tool that may contact GitHub, model hosts, video platforms, and user-provided URLs. Use --no-update-check in restricted environments, avoid sensitive/internal URLs, prefer local media files, and treat downloaded or untrusted videos as potentially resource-intensive.
# GitHub 仓库信息（用于检查更新）
GITHUB_REPO = "njhskills/video-analyzer"
GITHUB_API_URL = f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest"
GITHUB_TAGS_URL = f"https://api.github.com/repos/{GITHUB_REPO}/tags"
# 本地版本文件缓存# GitHub 仓库信息（用于检查更新）
GITHUB_REPO = "njhskills/video-analyzer"
GITHUB_API_URL = f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest"
GITHUB_TAGS_URL = f"https://api.github.com/repos/{GITHUB_REPO}/tags"
# 本地版本文件缓存
CACHE_FILE = ".update_cache.json"video_path
]
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:
error_msg = result.stderr or "未知错误"
# 检查是否是文件损坏output_path
]
result = subprocess.run(cmd, capture_output=True)
if result.returncode != 0:
error_msg = result.stderr.decode() if result.stderr else "未知错误"
if "Invalid data" in error_msg:output_pattern
]
result = subprocess.run(cmd, capture_output=True)
if result.returncode != 0:
error_msg = result.stderr.decode() if result.stderr else "未知错误"
raise RuntimeError(f"帧提取失败: {error_msg}")output_path
]
result = subprocess.run(cmd, capture_output=True)
if result.returncode != 0:
logger.warning(f"关键帧提取失败 (t={ts}s): {result.stderr.decode()}")# 安装命令: pip install -r requirements.txt # === 核心依赖 === openai-whisper>=20231117 numpy>=1.24.0 PyYAML>=6.0 Pillow>=10.0.0
Detected: suspicious.insecure_tls_verification