Tianshu Wan Video

使用通义万相 2.6 生成视频，支持文生视频和图生视频。Node.js 实现，无需 Python。

Security Scan

The skill's code and runtime instructions match its description (it calls Alibaba DashScope video APIs and only needs a DashScope API key); nothing in the package suggests hidden behavior, though the source/author and homepage are missing which lowers confidence.

Purpose & Capability

The name/description say it generates videos with 通义万相 (DashScope) and the script calls https://dashscope.aliyuncs.com/api/v1 with a bearer token. Requiring DASHSCOPE_API_KEY is consistent and expected.

Instruction Scope

SKILL.md instructs running the included Node.js script with prompt/image-url args. The script only reads the declared DASHSCOPE_API_KEY env var and CLI args, calls the DashScope API, polls for task completion, and prints VIDEO_URL. It does not access unrelated files, other env vars, or external endpoints beyond the DashScope domain.

Install Mechanism

No install spec (instruction-only + small script). package.json has no dependencies; the script relies on global fetch (Node 18+). No downloads or archive extraction are present.

Credentials

Only one required credential (DASHSCOPE_API_KEY) is declared and used for Authorization in API calls. No other secrets or unrelated environment variables are requested.

Persistence & Privilege

The skill does not request always:true or any elevated persistent privileges, nor does it modify other skills or system configs. Autonomous invocation is allowed by default but not combined with other red flags.

Assessment

This skill appears to do what it says: it runs a Node.js script that calls Alibaba's DashScope video API and needs only DASHSCOPE_API_KEY. Before installing, consider: (1) the package has no published homepage or repository and the owner is unknown—this reduces trustworthiness; (2) the script makes network calls to dashscope.aliyuncs.com, so the API key will be sent to that service (expected for use); (3) ensure you only provide a DashScope API key you trust the skill to use. If you need higher assurance, ask the author for a code repository or verify the script locally in a controlled environment (check Node version compatibility and run it manually) before granting the key to an agent that could call it autonomously.

通义万相视频 (tianshu-wan-video)

直接调用阿里云通义万相 2.6 视频生成模型，Node.js 实现。

功能

• 文生视频 (t2v)
• 图生视频 (i2v)

前置配置

• DASHSCOPE_API_KEY - 阿里云 DashScope API Key

用法

# 文生视频
node scripts/generate_video.js t2v --prompt "电影感特写镜头，缓慢推进" --duration 5 --resolution 720P

# 图生视频
node scripts/generate_video.js i2v --prompt "镜头缓慢旋转" --image-url "https://example.com/image.jpg" --duration 4

输出

脚本输出 VIDEO_URL: <url>，提取该 URL 即可使用。