Ai Video Pipeline

This skill appears to implement what it promises (automatic TTS → video clip generation → compose), but there are several practical and security concerns you should consider before installing or running it: - Missing declared requirements: The registry metadata lists no required env vars or binaries, but the code needs VOLC_* keys (即梦AI / 火山播客), MINIMAX_API_KEY, ffmpeg/ffprobe, and multiple Python packages. Treat the metadata as incomplete; expect manual environment setup. - External network access: The skill connects to external endpoints (wss://openspeech.bytedance.com for TTS, visual.volcengineapi.com for video generation, api.minimaxi.com for music). Those are necessary for functionality, but supplying credentials gives the skill the ability to call those services on your behalf — provide the minimum-privilege keys and monitor usage/billing. - Delivery mismatch: SKILL.md says the produced MP4 will be sent via Feishu, but I found no Feishu integration in the code. Clarify how the agent will deliver the file in your deployment (or implement/inspect the delivery code) before trusting it with private outputs. - Dependency & runtime risk: The skill relies on native binaries (ffmpeg, ffprobe) and many Python libs (OpenCV, moviepy, websockets, funasr, volcenginesdkcore). Run in a sandbox or test environment first; do not run as a privileged user. - Storage & caching: Generated BGMs and subs are persisted under the skill directory and bgm/ — check disk usage and where files are stored if that matters for privacy/compliance. Recommendations: 1. Ask the publisher/owner for an updated manifest listing required env vars and Python/system dependencies, and for confirmation about Feishu delivery. 2. If you must test, do so in an isolated environment or container, and provide only least-privileged API keys (rotate them after testing). 3. Verify billing impacts on the external services (即梦AI per-second cost, MiniMax generation) before running at scale. 4. Inspect/replace the delivery code or disable auto-sending until you confirm how outputs are transmitted. Because of the metadata/code mismatches and missing dependency declarations, treat this skill as 'suspicious' until those gaps are resolved.