Feishu Video Editor

What to consider before installing or running this skill: - Feishu integration mismatch: The documentation promises downloading from and uploading to Feishu cloud, but the code does not show any Feishu API usage or request Feishu credentials. Expect that upload/download to Feishu will not work out-of-the-box. Ask the author for how Feishu auth should be provided (e.g., APP_ID/APP_SECRET or access token) and request a code path that uses those credentials. - Local execution & data exposure: The skill downloads/reads video files locally and writes temporary files (e.g., /tmp/*.json, temp audio/video clips). If you run this on sensitive videos, they will be processed locally and may be stored temporarily — run in an isolated environment if needed. - Model and network usage: Installing requirements installs openai-whisper and friends; loading Whisper will likely download model weights from the network and consume a lot of disk and bandwidth. Plan for this and run inside a controlled environment. - Shell injection risk: src/index.ts builds and execs a shell command by concatenating unescaped arguments. If a video path or other argument can be influenced by an untrusted user, this could allow command injection. Before using, patch runPythonScript to use execFile/spawn with an argument array (no shell interpolation) or properly sanitize/escape inputs. - Code completeness: The Python file posted is truncated but mostly does local processing. Review the full video_processor.py for any network calls, hidden endpoints, or unexpected behavior. Confirm there is no hard-coded upload endpoint or credentials in other parts of the repository. - Mitigations if you want to use it: run inside a dedicated unprivileged VM/container; review and fix the exec invocation to avoid shell interpolation; require and document Feishu credentials and implement/verify Feishu upload/download flows; run pip installs inside a virtualenv; test with non-sensitive sample videos first. Given the inconsistencies and the command-execution risk, treat this skill as suspicious until the Feishu integration and safe execution model are clarified and the shell-invocation issue is corrected.