基于需求描述智能生成脚本和视频，让你的每个营销视频都出彩。适用于用户希望“把这个需求直接生成视频”时，通过API自动生成结果而非人工撰写。

This skill implements the claimed video-generation workflow but contains two red flags you should consider before installing or using it: 1) Hard-coded token: The Python script includes a DEFAULT_TOKEN value. If that token is valid, the skill will operate using that account without you providing credentials. Ask the author what that token is for, and never rely on an unexplained embedded credential. Prefer a version that requires you to supply your own token via an environment variable. 2) Undeclared environment variables: The registry metadata declares no required env vars, but the code reads DASHBOARD_TOKEN, DASHBOARD_PHONE, DASHBOARD_PASSWORD, and DASHBOARD_BASE_URL. Treat these as sensitive. Do not provide personal credentials until you verify the service and token scope. Practical steps: - Ask the publisher to (a) remove the embedded DEFAULT_TOKEN or explain/rotate it, and (b) update the skill metadata and SKILL.md to clearly list required env vars and what each does. - If you must test it, run in a sandbox environment and do not supply real account credentials; create a dedicated test account with limited permissions. - Inspect network traffic or logs during a test to confirm calls only go to the documented xiaonian.cc endpoints. If the author can justify and remove the hard-coded token and correct the metadata/documentation, the skill becomes much less suspicious. Currently, the mismatch and embedded credential justify caution.