WeryAI video tool — subtitle erase

Remove burnt-in subtitles or on-screen text from an HTTPS video via WeryAI (video-subtitle-erase). Use when the user wants subtitle or text removal, not tran...

Security Scan

The skill's requirements, runtime instructions, and included script align with its stated purpose (calling WeryAI's subtitle-erase API for HTTPS-hosted videos) and do not request unrelated credentials or system-level access.

Purpose & Capability

Name/description match the implementation: the tool only calls a WeryAI video-subtitle-erase endpoint and requires a single API key (WERYAI_API_KEY) plus Node.js. There are no unrelated credentials, binaries, or config paths requested that would be disproportionate to subtitle/video text removal.

Instruction Scope

SKILL.md explicitly limits inputs to public https:// URLs and optional normalized rectangles, warns against local-file uploads, and requires explicit user confirmation before paid submission. The included script (video_subtitle_erase.js) validates HTTPS URLs, validates rects, reads only WERYAI_API_KEY from env, and performs network calls to api.weryai.com. The visible code does not reference other env vars, local files, or unexpected external endpoints.

Install Mechanism

No install spec is provided (instruction-only with a bundled script), which minimizes install-time risk. The only declared runtime binary is Node (>=18), which is reasonable for the provided JavaScript CLI. Nothing is downloaded or extracted by the skill itself.

Credentials

Only WERYAI_API_KEY is required and designated as the primary credential; the code reads that env var and constructs a Bearer Authorization header. No unrelated SECRET/TOKEN/PASSWORD vars are requested. The SKILL.md and script both state they do not depend on other env vars.

Persistence & Privilege

The skill does not request permanent system presence (always is false), does not modify other skills or global agent config, and contains explicit guidance not to write the API key to disk. Autonomous invocation is allowed (platform default) but not combined with other privileged actions.

Assessment

This package appears coherent with its stated purpose, but take these precautions before installing or running it: 1) Confirm you trust WeryAI and are willing to spend paid credits — the SKILL.md warns that runs are paid and not idempotent. 2) Only pass public https:// video URLs; do not supply local filesystem paths. 3) Verify the package contains only the listed files (SKILL.md, eval.yaml, scripts/video_subtitle_erase.js) and no extra scripts that accept local files or extra env vars. 4) Use the provided 'spec' and '--dry-run' modes to inspect the exact payload before submitting, and keep your WERYAI_API_KEY secret (do not write it to disk). 5) If you need higher assurance, inspect the full (untruncated) script for any hidden endpoints or obfuscated behavior; the portion provided shows only api.weryai.com usage and no other external hosts.

This skill is self-contained: it documents and runs only the subtitle-erase workflow on an existing video given by URL. It is not text-to-video or image-to-video generation from scratch.

Entry script: scripts/video_subtitle_erase.js (alongside this SKILL.md).

Runtime: WERYAI_API_KEY, Node.js 18+.

Inputs: video_url must be a public https:// URL. Optional rect_vo_list holds normalized box coordinates (0–1), not file paths. This script does not read local files and does not perform upload-file flows.

What this package ships (verify before trust)

Canonical layout for this skill only:

• SKILL.md, eval.yaml
• scripts/video_subtitle_erase.js (the only runnable script in scope)

If your copy also contains scripts/video_gen.js, scripts/video_toolkits.js, references/WERYAI_VIDEO_API.md, or other CLIs, those files are not part of this skill’s contract — they may come from another repo sync or an over-broad install. Do not run them when you only want subtitle-erase; remove them or reinstall from a clean source. Inspect what you run: node scripts/video_subtitle_erase.js spec.

Other tools (multi-endpoint CLIs, local-file upload to growth/upload-file APIs, extra environment variables in those CLIs) are out of scope for this package. This skill’s script uses only WERYAI_API_KEY and public https:// URLs.

API surface (this tool only)

• Required: video_url (public https:// URL)
• Optional: rect_vo_list — array of { lt_x, lt_y, rb_x, rb_y } in 0..1; omit for auto-detect

From this skill root, run node scripts/video_subtitle_erase.js spec to print the full tool schema (endpoint, required fields, defaults, enums) as JSON.

Pre-submit gate (mandatory)

Do not run submit / wait until the user explicitly confirms the video URL and any custom regions. Paid runs are not idempotent.

Workflow

Prefer --dry-run to validate JSON. Use wait to submit and poll until the task finishes; use submit only when the user wants a task_id without blocking, then status for later checks. Share final URLs as Markdown links [Video](https://…).

CLI

From this skill root:

node scripts/video_subtitle_erase.js wait \
  --json '{"video_url":"https://example.com/video.mp4"}'

node scripts/video_subtitle_erase.js submit \
  --json '{"video_url":"https://example.com/video.mp4"}'

node scripts/video_subtitle_erase.js status --task-id <task-id>

Dry-run:

node scripts/video_subtitle_erase.js wait \
  --json '{"video_url":"https://example.com/video.mp4"}' \
  --dry-run

Security

Never write WERYAI_API_KEY into files. Keep only WERYAI_API_KEY set for this workflow; do not rely on undocumented env vars in sibling scripts if any were mistakenly present. The in-scope script reads only WERYAI_API_KEY (no other env keys). video_subtitle_erase.js accepts only https:// media URLs (no disk read / no upload-file). Base URL and poll intervals are constants in the script, not env-driven.

Do not pass local filesystem paths or run tools that accept them unless you have explicitly reviewed and consented to their upload behavior — that is never required for this skill.

Out of scope

• Subtitle translation (different required fields)
• Watermark-only cleanup (different endpoint)
• Text-to-video from scratch

References

• WeryAI llms.txt