Security audit
Security checks across malware telemetry and agentic risk
The skill is a real video-editing workflow, but it needs review because it can alter the host Python environment and send video-derived data to multiple cloud services.
Review before installing. Use an isolated virtual environment or container, preinstall pinned dependencies instead of allowing runtime pip installs, and run it only on videos, transcripts, frames, and narration text you are comfortable sending to configured providers such as Anthropic, OpenAI, Qwen/DashScope, edge-tts, vectcut, or CapCut MCP. Require explicit confirmation before cloud processing, package installation, downloads, or saving drafts.
f.write(f"file '{os.path.abspath(p)}'\n")
output_path = os.path.join(output_dir, "output_video.mp4")
subprocess.run([
"ffmpeg", "-y",
"-f", "concat", "-safe", "0", "-i", concat_path,
"-vf", f"scale={original_width}:{original_height}"clip_path
]
result = subprocess.run(cmd, capture_output=True)
if result.returncode != 0:
print(f" Warning: clip {clip['clip_id']} render failed, skipping.")
continuefrom openai import OpenAI
except ImportError:
import subprocess, sys
subprocess.run([sys.executable, "-m", "pip", "install", "openai",
"--break-system-packages", "-q"], check=True)
from openai import OpenAItry:
import edge_tts
except ImportError:
subprocess.run([sys.executable, "-m", "pip", "install", "edge-tts",
"--break-system-packages", "-q"], check=True)
import edge_tts
clean = text.strip().strip("[]").strip()import anthropic
except ImportError:
import subprocess, sys
subprocess.run([sys.executable, "-m", "pip", "install", "anthropic",
"--break-system-packages", "-q"], check=True)
import anthropicimport anthropic
except ImportError:
import subprocess, sys
subprocess.run([sys.executable, "-m", "pip", "install", "anthropic",
"--break-system-packages", "-q"], check=True)
import anthropictry:
import edge_tts
except ImportError:
subprocess.run(
["pip", "install", "edge-tts", "--break-system-packages", "-q"],
check=True
)except ImportError:
print("openai-whisper not found. Installing...")
import subprocess
subprocess.run([sys.executable, "-m", "pip", "install", "openai-whisper",
"--break-system-packages", "-q"], check=True)
import whisperif state == "completed":
print(f"\nGeneration complete!")
dl_resp = requests.get(status["download_url"], stream=True, timeout=120)
Path(output_path).parent.mkdir(parents=True, exist_ok=True)
with open(output_path, "wb") as f:
for chunk in dl_resp.iter_content(8192):65/65 vendors flagged this skill as clean.
No suspicious patterns detected.