Huo15 Comic Storyboard

读 script.json + 角色卡，每个镜头生成 1 张关键帧（Seedream 4.0 图生图，传入该镜出场角色的三联卡做多图参考保持角色一致性）。触发词：分镜关键帧、storyboard、漫剧分镜图。

Security Scan

The skill mostly does what its description says (generate storyboard keyframes via Seedream), but the bundled code requires an undeclared ARK_API_KEY and will upload local reference images (and therefore could exfiltrate file contents) to an external API — the metadata and SKILL.md do not declare this or warn about it.

Purpose & Capability

The skill's purpose (generate one keyframe per scene using Seedream 4.0 with multi-image references) matches the code. However the published metadata lists no required credentials/env vars while the code (scripts/_shared/ark_api.py and scripts/storyboard.py) requires an ARK_API_KEY environment variable and will call the Volcengine/Ark endpoints. That credential is reasonable for the stated purpose, but it is missing from the declared requirements — an incoherence that should be fixed.

Instruction Scope

SKILL.md describes reading script.json and character cards and producing images; the implementation follows that. But the runtime will: (1) read the char manifest and any image paths it contains, (2) convert local image files into data URIs and send them to the external Ark image-generation endpoint, and (3) download generated image URLs. Concretely, any local file path included in the character manifest or passed as reference becomes base64-encoded and transmitted to an external service. SKILL.md does not mention the need to avoid sensitive local paths or warn that local files will be uploaded. This is a potential data-exfiltration vector and scope creep relative to a purely local image-generation helper.

Install Mechanism

There is no install spec; the skill is instruction + bundled Python scripts. Nothing is downloaded from arbitrary URLs during install. That minimizes supply-chain install risk. Runtime does perform network calls to external APIs, which is expected for this skill.

Credentials

The code requires an ARK_API_KEY (raised as RuntimeError if missing), but the registry metadata declares no required environment variables or primary credential. No other unrelated credentials are requested. The missing declaration is the main issue: a sensitive API key is required at runtime but not surfaced to the user/installer. The skill also uses filesystem reads (character manifests and any reference image paths) and will send those to the external service, so the API key grants the skill ability to transmit local file contents to Ark.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide settings. It writes .checkpoint.json and .cost.json under the project/out parent directory (normal for job state and billing tracking). No other elevated persistence or cross-skill changes were found.

What to consider before installing

Before installing or running this skill, note these points: - Runtime credential: The code requires an ARK_API_KEY (a bearer API key for the Volcengine/Ark endpoints) but the skill metadata and SKILL.md do not declare this. You will need to provide that key for the script to run. - Data leakage risk: Any local image file paths listed in the character manifest (or otherwise passed as reference images) will be base64-encoded and uploaded to Ark's API. Do not include any sensitive or private files in character manifests. Treat the API key as sensitive because it authorizes uploads. - Network access & trust: The skill sends prompts, reference images, and receives generated-image URLs from an external service (ark.cn-beijing.volces.com by default). Confirm you trust that service's data retention and privacy policies before sending proprietary content. - Cost and state: The skill records cost and progress to .cost.json and .checkpoint.json in the project directory; verify cost_cap and run on a small demo first to estimate expense. - Actionable fixes: Ask the publisher to (1) declare ARK_API_KEY (primary credential) in the registry metadata and SKILL.md, (2) add a clear warning that local files included as reference images will be uploaded, and (3) optionally add an explicit opt-in/confirmation step before uploading non-demo files. If you can't verify the publisher or don't trust the remote API, run the tool in an isolated environment and avoid pointing it at sensitive local files.

火15 漫剧-分镜关键帧 Skill

一镜一图，角色锁定由 Seedream 4.0 多图参考保证。

---

输入 / 输出

python scripts/storyboard.py \
  --script output/demo/script.json \
  --char-dir output/demo/characters \
  --out-dir output/demo/storyboard

输出：

storyboard/
├── S01.png
├── S02.png
├── ...
└── manifest.json  # {"S01": {"path": "...", "prompt": "..."}}

提示词模板

prompt = f"{STYLE_PREFIX}，{scene.location}，{scene.time}。{scene.action}。{scene.camera}。{scene.mood}氛围。"
reference_images = [char_full for char_id in scene.characters]  # 多图参考保角色一致

Seedream 4.0 支持最多 4 张 reference_image，超过时只取全身立绘。

细节规则

• 竖屏 9:16，尺寸 768x1344（比 1024x1792 省成本）
• 失败重试 2 次
• 每个 scene 的 prompt 中不带对白（对白后面 TTS 环节加）