FCPX Assistant

Final Cut Pro X (FCPX) 助手 — 全自动视频生产（从主题到发布）、TTS 配音、素材搜集、自动成片、调色、B-roll 插入、FCP 项目管理、剪辑辅助。触发词: FCPX, FCP, Final Cut, 做视频, 自动成片, 配音, voiceover, 素材, 导入素材, 导出, 发布...

Security Scan

The skill largely implements a Final Cut/auto-video toolset, but several hidden requirements and sensitive behaviors (undeclared API keys, default external API endpoint, and instructions to store site cookies) don't match the declared metadata and raise privacy/credential-risk concerns.

Purpose & Capability

The scripts and SKILL.md implement video production, FCP control (osascript), TTS, media collection, and publishing — all coherent with the skill name. However, the ai-script-generator expects a DASHSCOPE_* API (DASHSCOPE_API_KEY, DASHSCOPE_API_BASE, DASHSCOPE_MODEL) and defaults to a non-standard endpoint (dashscope.aliyuncs.com) which is not documented in the SKILL.md summary or registry metadata. The package.json version (2.4.2-beta) also doesn't match the registry metadata version (3.0.0-beta), and the skill claims no required env vars while code clearly uses several.

Instruction Scope

Runtime instructions direct running many shell scripts (ffmpeg, edge-tts, whisper, osascript) and starting a web UI on localhost:7861. The scripts will create config files under $HOME/.fcpx-assistant/publish and instruct users to paste website cookies (via browser dev tools) into JSON files — this is sensitive because cookies can grant account access. ai-script-generator sends prompts and topics to an external API endpoint (dashscope) using an API key environment variable; that transmits user-provided topics and generated content off-host. These credential- and data-transmission actions are outside what the registry metadata declared.

Install Mechanism

No install spec is provided (instruction-only install), and all files are included in the bundle. There are no remote downloads or URL shorteners in the included files. The risk surface comes from executing provided scripts, not from an external installer fetching arbitrary archives.

Credentials

Registry metadata declares no required environment variables or credentials, but scripts reference multiple sensitive config points: DASHSCOPE_API_KEY / DASHSCOPE_API_BASE / DASHSCOPE_MODEL in ai-script-generator.sh; optional PEXELS_API_KEY and PIXABAY_API_KEY in references; and platform publishing credentials/cookies stored under ~/.fcpx-assistant/publish/*.json (bilibili/youtube/tiktok/xiaohongshu). The skill asks users to copy browser cookies into config files — a high-risk operation. These environment/credential needs are not declared in the skill metadata and are disproportionate to the transparency expected.

Persistence & Privilege

The skill does not set always:true and does not request system-wide privilege. It writes configuration to a per-user directory (~/.fcpx-assistant) and launches a local web UI; both are normal for this class of tool. There is no evidence it modifies other skills or global agent settings.

What to consider before installing

What to consider before installing/running this skill: - Hidden API key requirement: The ai-script-generator script requires DASHSCOPE_API_KEY (and optionally DASHSCOPE_API_BASE/MODEL). The skill metadata declared no env vars, so if you run the generator it will fail or attempt to call the default external endpoint (dashscope.aliyuncs.com). Treat that external API as a third party that will receive your topics and prompts. - Cookie-based publishing is sensitive: The auto-publish flow asks you to paste browser cookies into JSON files stored under ~/.fcpx-assistant/publish/*.json. Cookies can grant access to your accounts; do not paste cookies unless you understand the risk. If you must use automatic publishing, prefer OAuth/official APIs and limit file permissions (chmod 600) and consider using service accounts with limited scope. - Local web UI: start-webui.sh launches a local server on http://localhost:7861. Running a web UI increases attack surface; review webui/app.py before exposing it, and do not run it on a machine with sensitive data unless you trust the code. - Default external AI endpoint: The scripts default to a non-standard 'DASHSCOPE' API. If you prefer local models or a provider you control, modify the scripts to use your provider or require an explicitly set API_BASE/API_KEY. - Inspect and sandbox: Because the bundle includes many executable shell and Python scripts, review the code (you have it) and run it in an isolated environment (VM or disposable macOS machine) before using on your main workstation. Pay attention to any scripts that use curl/eval/eval of constructed commands or write files in home directories. - Avoid pasting passwords: The skill suggests cookies instead of passwords; don't store plaintext passwords in these JSON files. Use least-privileged credentials and rotate them. - Miscellaneous: Owner and homepage are unknown; package.json and registry versions mismatch. These are signs of low provenance — prefer well-documented sources or fork and harden the scripts yourself before trusting them. If you want, I can: (1) point to the exact lines that reference each credential/cookie, (2) suggest safe edits to avoid external API calls, or (3) produce a checklist for sandboxed testing of the skill.

Final Cut Pro 助手

全自动视频生产线 + FCP 日常剪辑助手。

核心工作流

主题 💡 → AI 文案 📝 → 搜素材 🔍 → TTS 配音 🎤 → 自动成片 🎞️ → 调色 🎨 → B-roll 🎬 → 发布 🚀

一键全流程

bash scripts/auto-video-from-topic.sh \
    --topic "如何制作一杯完美的咖啡" \
    --publish bilibili \
    --title "咖啡教程" --tags "咖啡，教程"

分步执行

Step 1: AI 文案 — 根据主题生成分镜脚本 + 配音文本 + 素材关键词

bash scripts/ai-script-generator.sh --topic "主题" --style 教程 --duration 90 --keywords

Step 2: 搜集素材 — 从 Pexels/Pixabay 下载免费素材

bash scripts/media-collector.sh --keywords "nature ocean sunset" --count 5 --output ./my-project

Step 3: 背景音乐 — 把 BGM (mp3/wav/m4a) 放入 ./my-project/music/

bash scripts/music-collector.sh --keywords "轻松 愉快" --count 3 --output ./my-project/music

Step 4: TTS 配音 — edge-tts 生成配音（免费、稳定、支持多声线）

bash scripts/tts-voiceover.sh --script-file ./script.txt --output ./my-project/voiceover --merge
# 可选声音：--voice zh-CN-YunxiNeural (男) / zh-CN-XiaoxiaoNeural (女)

Step 5: 自动成片 — 素材 + 配音 + 字幕 + BGM 组装成完整视频

bash scripts/auto-video-maker.sh \
    --project ./my-project --script-file ./script.txt \
    --voiceover ./my-project/voiceover --style vlog --output final.mp4

智能特性：配音时长自动对齐、PingFang SC 字幕烧入、BGM 自动降到 15%、fade 转场、自动清理中间文件。

Step 6: 调色（可选）

bash scripts/auto-color-grade.sh final.mp4 final-graded.mp4 --style cinematic --intensity 0.7

风格：natural / cinematic / vintage / fresh / warm / cool

Step 7: B-roll 插入（可选）

bash scripts/auto-broll-insert.sh final.mp4 ./broll/ output.mp4 --script script.txt --transition fade

自动在场景转换处插入，支持文案关键词智能匹配。

Step 8: 发布

bash scripts/auto-publish.sh --video final.mp4 --platform bilibili --title "标题" --tags "标签"

支持 bilibili / youtube / tiktok / xiaohongshu。配置详情见 references/publishing.md。

---

项目目录结构

my-project/
├── videos/     ← 素材（Step 2 自动填充）
├── music/      ← BGM（Step 3）
├── voiceover/  ← 配音（Step 4 自动生成：vo_000.wav, vo_001.wav...）
└── meta/       ← 元数据（自动生成）

---

FCP 项目管理

osascript scripts/check-fcp.scpt             # 检查 FCP 状态
osascript scripts/list-projects.scpt          # 列出所有项目
osascript scripts/open-project.scpt "名称"     # 打开项目
osascript scripts/import-temp-media.scpt      # 导入临时素材
osascript scripts/project-time-tracking.scpt  # 时间追踪
osascript scripts/create-script.scpt "标题" "内容"  # 创建文案
osascript scripts/list-scripts.scpt           # 列出文案

剪辑辅助

bash scripts/scene-detect.sh video.mp4          # 场景检测
bash scripts/auto-rough-cut.sh video.mp4         # 自动粗剪（去静音）
bash scripts/smart-tagger.sh ./media/            # 智能标签
bash scripts/auto-chapter-marker.sh video.mp4    # 自动章节标记
bash scripts/audio-normalizer.sh video.mp4       # 音频标准化 (-23 LUFS)
bash scripts/auto-voiceover.sh "文本" out.wav     # 单文件配音 (edge-tts)
bash scripts/multi-lang-subtitles.sh video.mp4 en  # 多语言字幕 (Whisper)
bash scripts/auto-thumbnail.sh video.mp4 ./thumbs  # 关键帧缩略图

新功能

bash scripts/auto-bgm-match.sh -v video.mp4 -m ./bgm/ -o output.mp4   # 智能 BGM 匹配
bash scripts/multi-platform-export.sh video.mp4 -p tiktok bilibili     # 多平台适配导出
bash scripts/subtitle-styler.sh --srt sub.srt --style cinematic        # 字幕样式增强
bash scripts/video-analyzer.sh video.mp4                                # 视频质量分析
bash scripts/intro-outro-generator.sh --title "标题" --type intro       # 片头片尾生成
bash scripts/cover-generator.sh --video video.mp4 --title "标题" --all  # 封面图生成

Web UI

bash start-webui.sh   # 启动后访问 http://localhost:7861

一键成片界面，含实时进度条、分步工具、项目历史、调色/B-roll 控制。

---

参考文档

• 风格预设 & 所有参数: references/styles-options.md
• 平台发布配置: references/publishing.md
• 依赖安装 & TTS 部署: references/dependencies.md

必需依赖速查

ffmpeg (drawtext) · osascript · curl · jq · edge-tts (pipx install edge-tts) · whisper (brew install openai-whisper)

安装详情见 references/dependencies.md。