dpp-pipeline

• Verdict: Pass
• Confidence: High
• Analyzed: Apr 16, 2026, 3:55 AM
• Findings: 0
• Version: 1.0.2

Overview

The skill's requests, scripts, and code are coherent with its stated purpose (creating a single-product placement video) and its required credential (ARK_API_KEY); no obvious misdirection or unrelated privilege requests were found.

This skill appears to do what it claims: it uploads local media to Ark (required) and can optionally upload reference media to a TOS bucket if TOS credentials are provided. Before installing/running: (1) provide only a dedicated workspace directory and avoid placing unrelated secrets in its .env (the skill will load that file); (2) be aware scripts will create a local .venv and pip-install packages from PyPI (network activity during bootstrap); (3) do not run this on sensitive videos you don't want uploaded to Ark/TOS; (4) if you require higher assurance, inspect runtime/src/dpp_storyboard/ark_client.py and compose/upload paths and test in an isolated environment. Overall the required binaries, env vars, and network behavior are proportionate to the stated purpose.