FCPX Assistant

What to consider before installing/running this skill: - Hidden API key requirement: The ai-script-generator script requires DASHSCOPE_API_KEY (and optionally DASHSCOPE_API_BASE/MODEL). The skill metadata declared no env vars, so if you run the generator it will fail or attempt to call the default external endpoint (dashscope.aliyuncs.com). Treat that external API as a third party that will receive your topics and prompts. - Cookie-based publishing is sensitive: The auto-publish flow asks you to paste browser cookies into JSON files stored under ~/.fcpx-assistant/publish/*.json. Cookies can grant access to your accounts; do not paste cookies unless you understand the risk. If you must use automatic publishing, prefer OAuth/official APIs and limit file permissions (chmod 600) and consider using service accounts with limited scope. - Local web UI: start-webui.sh launches a local server on http://localhost:7861. Running a web UI increases attack surface; review webui/app.py before exposing it, and do not run it on a machine with sensitive data unless you trust the code. - Default external AI endpoint: The scripts default to a non-standard 'DASHSCOPE' API. If you prefer local models or a provider you control, modify the scripts to use your provider or require an explicitly set API_BASE/API_KEY. - Inspect and sandbox: Because the bundle includes many executable shell and Python scripts, review the code (you have it) and run it in an isolated environment (VM or disposable macOS machine) before using on your main workstation. Pay attention to any scripts that use curl/eval/eval of constructed commands or write files in home directories. - Avoid pasting passwords: The skill suggests cookies instead of passwords; don't store plaintext passwords in these JSON files. Use least-privileged credentials and rotate them. - Miscellaneous: Owner and homepage are unknown; package.json and registry versions mismatch. These are signs of low provenance — prefer well-documented sources or fork and harden the scripts yourself before trusting them. If you want, I can: (1) point to the exact lines that reference each credential/cookie, (2) suggest safe edits to avoid external API calls, or (3) produce a checklist for sandboxed testing of the skill.