Zyt one click video creation
Analysis
The skill is coherent for one-click short-video creation, but it requires trusting it with Chanjing API credentials and with sending scripts/audio/prompts to Chanjing services while running local media tools.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
r = subprocess.run(argv, capture_output=True, text=True, timeout=timeout, env={**os.environ, **(env or {})})The renderer executes local command-line tools such as ffmpeg and ffprobe through subprocess calls, which is central to the stated media-rendering purpose.
Source: unknown; No install spec — this is an instruction-only skill.
The registry does not identify the source provenance, although there is no automatic install script in the provided artifacts.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
CONFIG_FILE = CONFIG_DIR / "credentials.json" ... "app_id": app_id, "secret_key": secret_key ... data["access_token"] = token; write_config(data)
The client reads Chanjing app credentials from a local file, exchanges them for an access token, and writes token state back to the credentials file.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
运行过程中会调用蝉镜开放 API、上传切段音频、下载生成媒体，并在本地输出目录写入中间文件与最终 mp4。
The skill explicitly sends generated audio and generation requests to an external provider and downloads generated media.