Volcengine AI MediaKit

火山引擎 AI MediaKit 音视频处理 Skill。当用户需要对音视频进行加工处理时触发。处理完成后自动查询任务状态并返回产物播放链接。核心能力分为七类：1. 视频处理：多片段拼接、片段裁剪、画面翻转、视频播放调速、音频播放调速、图片合成视频、音画合成、提取音轨、音频混音; 2. 音频处理：人声/伴奏分离、...

This package appears to implement the advertised Volcengine media-processing features and legitimately needs Volcengine API credentials and a VOD space name. Before installing/using: 1) Only provide the VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY to accounts you trust; the scripts will use them to call VOD/TOS endpoints and to upload media. 2) Review any .env file in the working directory — the skill will auto-load it and may pick up unrelated secrets. 3) Be aware the allowed local-upload directories are determined from WORKSPACE (if set) or the current working directory plus a userdata sibling and /tmp — do not set WORKSPACE to a directory containing sensitive files. 4) If you will run this in a multi-tenant or sensitive environment, run it in an isolated environment (container/VM) so media uploads and network calls are separated from other services. 5) Optionally review vod_transport and any omitted helper files (not fully shown) to confirm there are no unexpected external endpoints or behaviors. These caveats are routine for tools that talk to cloud APIs and do not by themselves indicate malice.

Type: OpenClaw Skill Name: volcengine-ai-mediakit Version: 1.0.5 The volcengine-ai-mediakit skill bundle is a comprehensive and well-documented integration for Volcengine's AI MediaKit services, covering video/audio editing, AI enhancement, and translation. The implementation is transparent, using standard Python libraries and clear API interaction logic (HMAC-SHA256 signing in volc_request.py). Notably, upload_media.py includes a security check (_validate_local_path) that restricts local file access to authorized directories like workspace/ and /tmp. Furthermore, the instructions in SKILL.md and drama_script.py explicitly forbid the agent from downloading or decompressing remote artifacts, mitigating risks associated with processing untrusted data. No malicious intent, obfuscation, or unauthorized data exfiltration behaviors were detected.