Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local text-to-video workflow that writes project files and runs local media tools with user confirmation.
Install only if you are comfortable with a local workflow that runs preinstalled media tools and writes a project directory. Confirm the project path before generation or rendering, keep the default local-only TTS path unless you explicitly approve a separate reviewed online integration, and adapt the Chinese-oriented template if your video language differs.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
venv/
# Env
.env
.env.local
# Build / render output (when skill is used to create projects)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Env
.env
.env.local
# Build / render output (when skill is used to create projects)
renders/
声明描述的是一个更完整的文稿制作流程，输出应包括可编辑 HTML composition 与 MP4，并强调默认本地处理、联网需额外确认。实际代码仅是一个本地批量 TTS 脚本：解析 JSON 场景列表，调用 macOS say 生成 AIFF，再用 ffmpeg 转成每段 MP3，最后合并为 full.mp3。从安全/资源角度看，它符合“仅本地工具、无联网”的部分声明，没有发现未声明的联网、安装或越权访问行为；但从能力和主要用途看，代码与声明存在明显不一致，因为它没有实现 HTML/MP4 制作，而只是音频旁白生成组件。因此应判定为描述与实际行为不匹配。
The title and core description are written as Chinese-only operational guidance for the handoff process, and the examples and requirements throughout the file assume Chinese usage. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
The file instructs contributors to update sections named "详细参考" and "版本", which implies a fixed language convention in project documentation. Because the instructions do not explain the locale requirement or offer a language choice, this can be a natural-language policy issue under the language/locale rule.
The document sets lang="zh", which hard-codes a specific language/locale in the template. Under the policy rules, forcing a language without user opt-in or a clearly documented region-specific justification is a natural-language policy concern.