YouTube Shorts 자동 생성

AI/DevOps 유튜브 숏츠 자동 생성. 트렌드 수집 → 스크립트 → 이미지 → Veo 영상 → TTS 나레이션 → Remotion 합성 → YouTube 업로드

Security Scan

The skill's high-level purpose matches what the instructions do, but the runtime instructions ask the agent to fetch and execute external code and reference upload/costly services without declaring the needed credentials — that mismatch and remote-code execution are concerning.

Purpose & Capability

The name/description (YouTube Shorts 자동 생성) aligns with the pipeline described (trend → script → images → video → TTS → upload). However the skill instructs downloading and running a GitHub repo and executing uploads, yet the declared requirements only include GEMINI_API_KEY. Uploading to YouTube and using a service named 'Veo' would normally require additional credentials or configuration; those are not declared. This is an unexplained gap between claimed capabilities and declared requirements.

Instruction Scope

The SKILL.md instructs the agent to git clone a repository (https://github.com/kangjjang/youtube-shorts-skill.git), run scripts/setup.sh, create/activate a Python virtualenv, pip install requirements, and run python/node code. Those steps download and execute arbitrary third-party code at runtime and write to disk. The instructions also reference ${CLAUDE_PLUGIN_ROOT} and numerous CLI invocations (including upload flags). The instructions do not constrain what the cloned code does or enumerate required additional env vars/secrets, giving broad runtime discretion.

Install Mechanism

Although the skill bundle has no formal install spec, the runtime instructions perform a git clone from a third-party GitHub repo and run a setup script + pip install. Downloading and executing remote code via an unaudited repo and running arbitrary setup scripts is a higher-risk install mechanism. GitHub is a known host (better than an unknown IP/shortener), but the repo owner is unknown and the repository contents are not provided for review.

Credentials

The skill declares only GEMINI_API_KEY as a required env var, saying Gemini will be used for text/image/video/TTS. But the SKILL.md also references uploading to YouTube and uses a separate service 'Veo' with per-video costs. No YouTube OAuth credentials, client_secrets, or Veo API key are requested or documented. The absence of declared credentials for upload and external video-generation services is disproportionate and unexplained.

Persistence & Privilege

always:false (good), but the skill instructs fetching and executing external code and can be invoked autonomously (platform default). Combining autonomous invocation with runtime download/execute of a third-party repo increases blast radius if the repo is malicious or changes later. The skill writes a venv, installs packages, and writes outputs to disk — expected, but higher-risk given remote code execution.

What to consider before installing

This skill asks the agent to clone and run a GitHub repository and to install packages, then run commands that can upload videos. Before installing or running it: 1) Inspect the repository (https://github.com/kangjjang/youtube-shorts-skill.git) and review scripts/setup.sh and requirements.txt for unexpected behavior. 2) Confirm where YouTube upload credentials and any Veo (or other paid service) API keys are configured — do not provide your YouTube OAuth tokens unless you trust and have inspected the code. 3) Consider running the code in an isolated sandbox or ephemeral VM first to observe network calls and file writes. 4) If you only want the instruction logic and not remote code execution, ask the publisher to include the scripts in the skill bundle or to declare all required credentials and explain upload flow. 5) If you cannot audit the repo, do not supply GEMINI_API_KEY or other secrets to an unreviewed skill.

이 스킬은 AI/DevOps 주제의 60초 한국어 유튜브 숏츠를 자동으로 생성합니다.

사용법

사용자가 다음과 같이 요청하면 이 스킬을 실행하세요:

• "숏츠 만들어줘"
• "숏츠 주제 뽑아줘"
• "[주제명] 숏츠 만들어줘"
• "트렌드만 수집해줘"

설치

소스코드 전체가 필요합니다. GitHub에서 클론하세요:

git clone https://github.com/kangjjang/youtube-shorts-skill.git
cd youtube-shorts-skill
bash scripts/setup.sh

실행 방법

스킬 루트 디렉토리: ${CLAUDE_PLUGIN_ROOT} (Claude Code) 또는 클론한 레포 디렉토리

1. 환경 확인

cd ${CLAUDE_PLUGIN_ROOT:-youtube-shorts-skill}
source .venv/bin/activate 2>/dev/null || { python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt; }

2. 명령어

요청	실행 명령
전체 파이프라인 (대화형)	python main.py
자동 선택 + 비공개 업로드	python main.py --auto --upload
특정 주제로 생성	python main.py --auto generate --topic "주제명"
트렌드만 수집	python main.py trends
기존 영상 업로드	python main.py upload --dir outputs/디렉토리
고품질 모드	python main.py --auto --quality full

3. 파이프라인 흐름

트렌드 → 주제 → 스크립트 → 이미지 → Veo 클립 ─┐
                                                 ├→ Remotion 합성 → SEO → 업로드
                          스크립트 → Gemini TTS ──┘

9단계: 트렌드 수집 → 주제 선정 → 스크립트 작성 → 이미지 생성 → Veo 영상 → TTS 나레이션 → Remotion 합성 → SEO → 업로드

4. 필수 환경변수

• GEMINI_API_KEY: Gemini API 키 (텍스트, 이미지, 영상, TTS 모두 사용)

5. 비용 안내

• Veo 3.1 Fast: 숏츠 1편당 ~$2.40
• Veo 3.1 Full: 숏츠 1편당 ~$7.20
• 영상 생성 전 비용 체크포인트에서 확인 가능

6. 출력 결과

outputs/YYYY-MM-DD-[slug]/ 디렉토리에:

• script.json — 스크립트
• frames/ — 키프레임 이미지
• clips/ — Veo 영상 클립
• narration.wav — TTS 나레이션
• final_shorts.mp4 — 최종 합성 영상
• seo.json — SEO 메타데이터