短视频一键生成器

短视频一键生成器 v3.0。输入主题+要点，AI自动完成分镜、生图、配音、字幕、渲染，输出1080×1920竖屏MP4。

Before installing or running: 1) Treat this as code you should review — open video_producer.py and inspect network calls, especially requests.post and any subprocess.run usage. 2) Do not supply high‑value keys without confidence: test first with IMAGE_BACKEND=placeholder and TTS_BACKEND=edge (free/local) so no external API calls are made. 3) Verify the MiniMax endpoint (MINIMAX_BASE) — it is not a widely known provider; confirm its legitimacy before entering MINIMAX_API_KEY. 4) Run the script inside an isolated environment or container (non‑privileged user) and avoid running as root. 5) Look for shell commands constructed from untrusted input (subprocess.run with shell=True) and avoid feeding untrusted data into the script until you can confirm sanitization. 6) Ask the author to update the registry metadata to declare required env vars and to provide the .env.example file referenced in README; absence of those files/metadata is a red flag. If you want, paste the remaining truncated parts of video_producer.py and I can re-check for more specific risks (e.g., exact ffmpeg command construction or any hidden endpoints).

Type: OpenClaw Skill Name: video-producer-v3 Version: 1.0.0 The skill bundle is classified as suspicious due to critical security vulnerabilities in video_producer.py, specifically shell injection risks. The script uses subprocess.run(shell=True) to execute ffmpeg and edge-tts commands constructed from unsanitized user input (e.g., the --topic and --points arguments), which could allow arbitrary command execution. While the code appears to legitimately implement the described AI video generation functionality and lacks evidence of intentional malice or data exfiltration, the high-risk implementation of system calls makes it unsafe for use without significant refactoring.