Phy Video Bgm

• Risk level: Low
• Analyzed: Mar 22, 2026, 2:05 PM
• Findings: 0
• Version: 1.0.2

Overview

The skill's runtime instructions require uploading videos to third‑party APIs and two API keys, but the registry metadata does not declare those required credentials — this mismatch and the privacy implications of sending videos externally merit caution.

Before installing or running this skill: (1) Expect your video files to be uploaded to Google Gemini and fal.ai Lyria2 — do not use with private, confidential, or regulated content unless you have reviewed those services' data-use and retention policies. (2) The SKILL.md requires GOOGLE_GENAI_API_KEY and FAL_API_KEY but the registry metadata does not declare them — treat that as an omission and only provide API keys with minimal scope and via a secure mechanism (avoid pasting long-lived keys into shared environments). (3) Run the recommended Python packages inside an isolated virtual environment and ensure FFmpeg is a trusted system install. (4) Test with non-sensitive sample videos to confirm behavior, check what data is sent (and whether you want that logged/retained), and verify that generated files are saved where you expect so nothing is overwritten. (5) If you need higher assurance, ask the author to update registry metadata to declare required env vars and to document privacy/retention for uploaded media.