Security audit
Security checks across malware telemetry and agentic risk
This skill does what it advertises, but it handles prompts, media, API keys, and saved outputs with enough under-disclosed and overbroad behavior that users should review it carefully before installing.
Install only if you trust the configured API provider and are comfortable sending prompts, uploaded media, local file contents, and bearer API keys to that provider. Rotate the bundled API key if it is real, avoid sensitive prompts or files, prefer trusted HTTPS endpoints, review where outputs are saved, and do not expose the Streamlit app on a network without adding URL validation and clearer credential handling.
resp = requests.post(url, headers=_headers(api_key), json=payload, timeout=60)
resp.raise_for_status()
image_url = resp.json()["data"][0]["url"]
return requests.get(image_url, timeout=60).content
def submit_video_task(base_url: str, api_key: str, model: str,or (data.get("videos") or [{}])[0].get("video_url")
or data.get("output", {}).get("url")
)
return requests.get(video_url, timeout=120).content
if status in ("FAILED", "ERROR", "CANCELLED"):
raise RuntimeError(f"Task failed with status: {status}")
time.sleep(5)```python
# 生成猫咪玩耍视频
result = run_openlens_task(
url="https://api.onlypixai.com/v1",
api_key="sk-px-xxxxxxxx",
model_id="video/wan2.6-t2v",
prompt="Two cats playing on grass, sunny day, realistic","properties": {
"url": {
"type": "string",
"description": "API base URL, e.g. https://api.onlypixai.com/v1"
},
"api_key": {
"type": "string",streamlit>=1.28.0 requests>=2.31.0
streamlit>=1.28.0 requests>=2.31.0
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.