Bailian Studio

This skill's code appears coherent with its advertised features, but there are important mismatches and privacy implications to check before installing: - Credentials: The package metadata claims no required env vars, but the code requires DASHSCOPE_API_KEY and a full OSS credential set (ACCESS_KEY, SECRET_KEY, BUCKET, ENDPOINT, REGION). These are mandatory for many flows and will raise runtime errors if missing. Confirm you are comfortable providing those secrets. - Data flow: Local reference images are uploaded to your configured OSS bucket by scripts/oss_upload.py and the code constructs public URLs. That means any local files you pass will be uploaded (and potentially publicly addressable depending on bucket ACLs). Avoid supplying private images unless you trust the bucket configuration. - Execution requirements: TTS playback uses ffplay (ffmpeg). If you don't want playback, use the --output option to save WAV instead. - Source provenance: The skill's registry metadata omitted required env vars and primary credential. That may be a packaging oversight, but it also makes it easy to miss the need for sensitive keys. Verify the author/source before adding credentials — prefer setting DASHSCOPE_API_KEY and OSS credentials via environment variables rather than leaving a secrets/bailian.env file in the repository. - Mitigations: Run the code in an isolated environment, inspect/modify scripts if you want uploads to go to a private location, and test with throwaway credentials or a test OSS bucket first. If you need the skill but don't want it to upload anything, pass only URL references to avoid local uploads.