Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly a disclosed video-production workflow, but it should be reviewed because it asks the agent to control a logged-in Chrome profile and includes unsafe cloud credential/storage guidance.
Review carefully before installing. Use a dedicated Chrome profile rather than your normal browser profile, avoid leaving remote debugging open, do not run it against untrusted storyboard titles or media folders, and replace the Tencent Cloud identifiers with your own least-privilege storage setup. Confirm any API calls or batch generation first because the workflow can consume credits, write many files, and automate logged-in web sessions.
print(" 📦 拼接视频片段...")
cmd = [ffmpeg_path, "-y", "-f", "concat", "-safe", "0",
"-i", str(concat_list), "-c", "copy", str(video_concat)]
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:
print(" ⚠️ copy模式失败，重编码...")
cmd = [ffmpeg_path, "-y", "-f", "concat", "-safe", "0",str(out_file)
])
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:
# 降级：不带字幕
cmd2 = ["-c:v", "libx264", "-preset", "fast", "-crf", "22",
"-pix_fmt", "yuv420p", "-c:a", "aac", "-b:a", "128k",
str(video_concat)]
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:
print(f" ❌ 拼接失败: {result.stderr[-300:]}")
return None"""查找FFmpeg路径"""
for p in ["/opt/homebrew/bin/ffmpeg", "/usr/local/bin/ffmpeg", "ffmpeg"]:
try:
subprocess.run([p, "-version"], capture_output=True)
return p
except (FileNotFoundError, OSError):
continuedef find_ffprobe():
for p in ["/opt/homebrew/bin/ffprobe", "/usr/local/bin/ffprobe", "ffprobe"]:
try:
subprocess.run([p, "-version"], capture_output=True)
return p
except (FileNotFoundError, OSError):
continue63/63 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec