Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

tencent mps skill

腾讯云 MPS 媒体处理服务。只要用户的请求涉及音视频或图片的处理、生成、增强、用量查询、内容理解、媒体质检,必须使用此 Skill。覆盖:转码/压缩/格式转换、画质增强/老片修复/超分、字幕提取/翻译/语音识别、去字幕/擦除水印/人脸模糊、图片超分/美颜/降噪、音频分离/人声提取/伴奏提取、AI生图/生视频、大...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
1 · 377 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The scripts and SKILL.md implement Tencent Cloud MPS tasks (transcode, enhance, AIGC, subtitles, COS upload/download, usage queries) which legitimately require Tencent credentials and COS config. That capability aligns with the skill description. However the registry metadata lists no required environment variables or primary credential while SKILL.md and the scripts clearly require TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY and often TENCENTCLOUD_COS_BUCKET/TENCENTCLOUD_COS_REGION — a discrepancy that should be corrected.
!
Instruction Scope
Runtime instructions and the scripts will: (1) automatically upload local files to COS when a user provides local paths (i.e., local files are transmitted to remote storage using the user's credentials), (2) rely on utility 'load_env' to auto-load or guide adding credentials to shell profile files (the docs instruct adding exports to ~/.profile or ~/.bashrc and the code will try to auto-load), and (3) print prompts suggesting the agent can ask the user to provide secret values in-chat to configure the environment. These behaviors expand scope beyond purely 'process this URL' — they involve handling secrets and moving user local files to remote cloud storage. Users should explicitly consent and understand that local files and credentials will be used.
Install Mechanism
There is no install spec (instruction-only style), which minimizes automated install risk. However the package includes many Python scripts that expect pip packages ('tencentcloud-sdk-python', 'cos-python-sdk-v5') and will be executed on demand; the code will be written to disk as part of the skill package and may be run by the agent. No remote downloads or obscure install URLs are used in the skill metadata.
!
Credentials
The scripts legitimately require Tencent Cloud SecretId/SecretKey and COS bucket/region. That is proportionate to media processing. However: (a) the registry metadata did not declare these env vars, which is misleading; (b) the SKILL.md and some scripts encourage storing credentials in shell profiles or providing them interactively, and the load_env helper attempts to auto-load (and possibly write) environment files — increasing risk if users paste long-lived credentials into chat or allow automatic writing to profile files. The skill does not request unrelated third-party credentials, but handling of sensitive keys is broad and needs careful limits.
Persistence & Privilege
The skill does not set always: true and does not claim to modify other skills. This is normal. One caveat: the included load_env helper and the SKILL.md ask users to export variables into ~/.profile or ~/.bashrc and the load_env module may read or write shell environment files; that gives the skill the potential to change persistent shell config if the user follows its automated guidance. Inspect load_env.py before allowing it to run or permit it to modify files.
What to consider before installing
What to check and do before using this skill: - Metadata mismatch: the registry metadata claims no required env vars, but SKILL.md and the scripts require TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY (and often TENCENTCLOUD_COS_BUCKET / TENCENTCLOUD_COS_REGION). Treat the skill as one that needs cloud credentials. - Inspect load_env.py first: it is referenced repeatedly and may read or write system profile files (~/.profile, ~/.bashrc, /etc/environment). Do not allow automatic modifications without reviewing the code. If you are not comfortable, set env vars manually or run scripts with explicit --secret-id/--secret-key options. - Minimize blast radius of credentials: use short-lived or least-privilege credentials (for example STS temporary tokens or an API key with permissions scoped only to the specific COS bucket and MPS actions). Avoid pasting long-lived root-style keys into chat. - Be aware local-file behavior: the skill explicitly uploads local files to COS when you supply local paths. That will transfer local data to remote storage under your credentials. If you have sensitive local content, do not use the automatic upload or test in an isolated environment. - Prefer CLI args over in-chat secrets: the scripts accept --secret-id/--secret-key; prefer passing secrets directly at runtime (in a secure terminal or via temporary environment) over sending them into an AI conversation. - Run in an isolated environment: install required Python packages in a virtualenv or container and run scripts there; inspect printed API calls by using --dry-run first. - Verify outputs and logs: check what is written to COS and any URLs generated (the code can produce presigned URLs). Restrict bucket/object ACLs to avoid accidental public exposure. - If you plan to enable this skill for autonomous use, consider stricter controls: do not allow the agent to request or store credentials autonomously; require human verification before uploading local files or writing env files. Given these inconsistencies and the sensitive actions (credential use, file uploads, potential profile modification), proceed only after reviewing load_env.py and the scripts and applying least-privilege credentials and isolation controls.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.9
Download zip
latestvk973j171fe1c9w59evb89gc5z9835wkb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

腾讯云媒体处理服务(MPS)

通过腾讯云官方 Python SDK 调用 MPS API,所有脚本位于 scripts/ 目录,均支持 --help--dry-run

详细参数:见 references/params.md 完整示例集:见 references/scripts-detail.md

环境配置

检查环境变量:

python scripts/load_env.py --check-only

配置(~/.profile~/.bashrc):

# 必须(所有脚本)
export TENCENTCLOUD_SECRET_ID="your-secret-id"
export TENCENTCLOUD_SECRET_KEY="your-secret-key"

# 以下场景必须配置 COS 变量:
#   1. 输入源为 --cos-object(即 COS 对象路径,非 URL)
#   2. 使用 mps_cos_upload.py / mps_cos_download.py 上传/下载本地文件
#   3. 脚本需要将处理结果写回 COS(OutputStorage)
export TENCENTCLOUD_COS_BUCKET="your-bucket"        # COS 存储桶名
export TENCENTCLOUD_COS_REGION="your-bucket-region" # 存储桶地域,如 ap-guangzhou

安装依赖:

pip install tencentcloud-sdk-python cos-python-sdk-v5

本地文件处理流程

MPS 只接受 URL 或 COS 对象作为输入,本地文件必须先上传

用户输入本地文件时的自动处理流程

当用户请求涉及本地文件路径(如 ./video.mp4/path/to/image.jpg)时,按以下步骤自动处理

步骤 1:上传文件到 COS

python scripts/mps_cos_upload.py --local-file <本地文件路径> --cos-key <目标路径>
  • 使用 --cos-key 指定合理的存储路径(默认路径 input/
  • 记录上传返回的 COS 信息:bucket、region、key

步骤 2:使用 COS 路径参数执行脚本 根据脚本类型,使用各个脚本中 传递 COS 路径的方式,如下: | 脚本 | COS 路径参数方式 | 示例 | | mps_transcode.py | --cos-object <key> | --cos-object input/video.mp4 | | mps_enhance.py | --cos-object <key> | --cos-object input/video.mp4 | | mps_erase.py | --cos-object <key> | --cos-object input/video.mp4 | | mps_subtitle.py | --cos-object <key> | --cos-object input/video.mp4 | | mps_imageprocess.py | --cos-object <key> | --cos-object input/image.jpg | | mps_qualitycontrol.py | --cos-object <key> | --cos-object input/video.mp4 | | mps_av_understand.py | --cos-object <key> | --cos-object input/video.mp4 | | mps_vremake.py | --cos-object <key> | --cos-object input/video.mp4 | | mps_aigc_image.py | --cos-input-bucket <b> --cos-input-region <r> --cos-input-key <k> | --cos-input-bucket xxx --cos-input-region ap-guangzhou --cos-input-key input/img.jpg | | mps_aigc_video.py | --cos-input-bucket <b> --cos-input-region <r> --cos-input-key <k> | --cos-input-bucket xxx --cos-input-region ap-guangzhou --cos-input-key input/img.jpg |

注意:使用 --cos-object 的脚本依赖环境变量 TENCENTCLOUD_COS_BUCKETTENCENTCLOUD_COS_REGION;AIGC 类脚本需要显式传递完整的 COS 信息。

步骤 3:下载处理结果(如需要)

python scripts/mps_cos_download.py --cos-key <输出key> --local-file <本地保存路径>

禁止的操作

禁止直接使用拼接的 URL 作为参数
例如:--url https://<bucket>.cos.<region>.myqcloud.com/<key>
原因:本地上传的文件可能没有公开读取权限,URL 访问会失败。

必须使用 COS 路径方式(bucket + region + key)

手动处理示例

如需手动执行,完整流程如下:

# 1. 上传
python scripts/mps_cos_upload.py --local-file ./video.mp4 --cos-key input/video.mp4
# 2. 执行任务(使用 COS 路径)
python scripts/mps_transcode.py --cos-object input/video.mp4
# 3. 下载结果
python scripts/mps_cos_download.py --cos-key output/result.mp4 --local-file ./result.mp4

返回结果含链接时,用 Markdown 格式返回给用户:[文件名](URL)

异步任务说明

所有脚本默认自动轮询等待完成。

  • 只提交不等待:加 --no-wait,脚本返回 TaskId
  • 手动查询:音视频用 mps_get_video_task.py,图片用 mps_get_image_task.py

脚本功能映射(职责边界)

选择脚本时必须严格按照映射关系,不得混用

用户需求类型使用脚本说明
检查画面质量、检测模糊/花屏mps_qualitycontrol.py唯一质检脚本--definition 60(默认)
检测播放兼容性、卡顿、播放异常mps_qualitycontrol.py唯一质检脚本--definition 70
音频质量检测、音频事件检测mps_qualitycontrol.py唯一质检脚本--definition 50
去除字幕、擦除水印、人脸/车牌模糊mps_erase.py仅用于画面内容擦除/遮挡
画质增强、老片修复、超分辨率mps_enhance.py视频画质提升
转码、压缩、格式转换mps_transcode.py编码格式处理
字幕提取、翻译、字幕类语音识别mps_subtitle.py字幕相关
图片处理(超分/美颜/降噪)mps_imageprocess.py图片增强
AI 生图(文生图/图生图)mps_aigc_image.pyAIGC 图片生成
AI 生视频(文生视频/图生视频)mps_aigc_video.pyAIGC 视频生成
音视频内容理解(场景/摘要/分析/语音识别)mps_av_understand.py大模型理解,必须提供 --mode--prompt
视频去重(画中画/视频扩展/换脸/换人等)mps_vremake.pyVideoRemake,必须提供 --mode
用量统计查询mps_usage.py调用次数/时长查询
查询音视频处理任务状态mps_get_video_task.pyProcessMedia 任务查询
查询图片处理任务状态mps_get_image_task.pyProcessImage 任务查询
上传本地文件到 COSmps_cos_upload.py本地→COS 前置步骤
从 COS 下载文件mps_cos_download.pyCOS→本地 后置步骤
列出 COS Bucket 文件mps_cos_list.py查看 COS 文件列表,支持路径过滤和文件名搜索

重要mps_erase.py 职责是擦除/遮挡画面视觉元素,不涉及质量检测。 "画质检测"、"模糊"、"花屏"、"播放兼容性"、"音频质检" → 必须用 mps_qualitycontrol.py

生成命令的强制规则

  1. 禁止占位符:所有参数值必须是真实值。若用户未提供必需值,先询问,不得用 <视频URL>YOUR_URL 等占位符。

  2. mps_qualitycontrol.py 必须含 --definition

    • 音频质检:--definition 50
    • 画面质检(默认):--definition 60
    • 播放兼容性:--definition 70
  3. mps_av_understand.py 必须含 --mode--prompt

    • --mode video(理解视频画面)或 --mode audio(仅音频,视频自动提取音频)
    • --prompt 控制大模型理解侧重点,缺失时结果可能为空

关键脚本说明

视频增强 (mps_enhance.py)

大模型增强模板(--template),按场景+目标分辨率选择:

场景720P1080P2K4K
真人(Real)327001327003327005327007
漫剧(Anime)327002327004327006327008
抖动优化327009327010327011327012
细节最强327013327014327015327016
人脸保真327017327018327019327020

去字幕擦除 (mps_erase.py)

预设模板:101 去字幕 | 102 去字幕+OCR | 201 去水印高级版 | 301 人脸模糊 | 302 人脸+车牌模糊

大模型音视频理解 (mps_av_understand.py)

通过 AiAnalysisTask.Definition=33 + ExtendedParameter(mvc.mode + mvc.prompt) 控制。

# 视频内容理解
python scripts/mps_av_understand.py \
    --url https://example.com/video.mp4 \
    --mode video \
    --prompt "请分析这个视频的主要内容、场景和关键信息"

# 音频模式(视频自动提取音频)
python scripts/mps_av_understand.py \
    --url https://example.com/video.mp4 \
    --mode audio \
    --prompt "请进行语音识别,输出完整文字内容"

# 对比分析(两段音视频)
python scripts/mps_av_understand.py \
    --url https://example.com/v1.mp4 \
    --extend-url https://example.com/v2.mp4 \
    --mode audio \
    --prompt "对比两段音频,分析差异"

# 查询任务
python scripts/mps_av_understand.py --task-id 2600011633-WorkflowTask-xxxxx --json

媒体质检 (mps_qualitycontrol.py)

# 画面质检(默认)
python scripts/mps_qualitycontrol.py --url https://example.com/video.mp4 --definition 60

# 播放兼容性质检
python scripts/mps_qualitycontrol.py --url https://example.com/video.mp4 --definition 70

# 音频质检
python scripts/mps_qualitycontrol.py --url https://example.com/audio.mp3 --definition 50

# 异步提交
python scripts/mps_qualitycontrol.py --url https://example.com/video.mp4 --definition 60 --no-wait

视频去重 (mps_vremake.py)

# 画中画去重(等待结果)
python scripts/mps_vremake.py --url https://example.com/video.mp4 --mode PicInPic --wait

# 视频扩展去重
python scripts/mps_vremake.py --url https://example.com/video.mp4 --mode BackgroundExtend --wait

# 换脸模式
python scripts/mps_vremake.py --url https://example.com/video.mp4 --mode SwapFace \
    --src-faces https://example.com/src.png --dst-faces https://example.com/dst.png --wait

# 换人模式
python scripts/mps_vremake.py --url https://example.com/video.mp4 --mode SwapCharacter \
    --src-character https://example.com/src_full.png \
    --dst-character https://example.com/dst_full.png --wait

# 画中画 + LLM 提示词
python scripts/mps_vremake.py --url https://example.com/video.mp4 --mode PicInPic \
    --llm-prompt "生成一个唯美的自然风景背景图片" --wait

# 异步提交(默认,不加 --wait)
python scripts/mps_vremake.py --url https://example.com/video.mp4 --mode PicInPic

# 查询任务
python scripts/mps_vremake.py --task-id 2600011633-WorkflowTask-xxxxx --json

去重模式PicInPic(画中画)BackgroundExtend(视频扩展)VerticalExtend(垂直填充)HorizontalExtend(水平填充)AB(视频交错)SwapFace(换脸)SwapCharacter(换人)
主要参数--url / --cos-object / --task-id / --mode(必填)/ --wait / --llm-prompt / --llm-video-prompt / --src-faces+--dst-faces(换脸)/ --src-character+--dst-character(换人)/ --json / --dry-run

用量统计 (mps_usage.py)

python scripts/mps_usage.py --days 30 --all-types
python scripts/mps_usage.py --start 2026-01-01 --end 2026-01-31
python scripts/mps_usage.py --type Transcode Enhance AIGC AIAnalysis

--type 支持:Transcode Enhance AIAnalysis AIRecognition AIReview Snapshot AnimatedGraphics AiQualityControl Evaluation ImageProcess AddBlindWatermark AddNagraWatermark ExtractBlindWatermark AIGC

API 参考

脚本文档
mps_transcode.py / mps_enhance.py / mps_subtitle.py / mps_erase.pyProcessMedia
mps_qualitycontrol.pyProcessMedia AiQualityControlTask
mps_imageprocess.pyProcessImage
mps_av_understand.pyVideoComprehension AiAnalysisTask
mps_vremake.pyVideoRemake AiAnalysisTask
mps_aigc_image.pyCreateAigcImageTask
mps_aigc_video.pyCreateAigcVideoTask
mps_usage.pyDescribeUsageData
mps_get_video_task.pyDescribeTaskDetail
mps_get_image_task.pyDescribeImageTaskDetail

Files

22 total
Select a file
Select a file to preview.

Comments

Loading comments…