AI视频短视频创作器

Two-phase AI-narrated video short creator with human review checkpoints. Phase 1 analyzes source materials, generates TTS narration via edge-tts, and exports...

This skill appears to do what it says (local TTS + FFmpeg video assembly), but review the code before running: 1) step1_generate_review.py has a missing import for edge_tts and will crash unless corrected — the second script contains a safer async TTS generator that imports edge_tts locally. 2) step2_edit_video.py constructs an ffmpeg command string and runs it via os.system; if any clip paths are attacker-controlled or contain shell metacharacters this could lead to command injection — prefer using subprocess with a list of args or sanitize/validate paths. 3) The tool imports a user-supplied config.py (this executes code) so only use configs from trusted sources. 4) edge-tts will contact Microsoft TTS endpoints (no API key), so expect network traffic for TTS. If you plan to run this, (a) run it in a controlled environment, (b) inspect/validate clip filenames in your config, (c) patch step1 to import edge_tts or use the step2 helper that imports it, and (d) replace the os.system ffmpeg invocation with subprocess.run(list_args) or use the provided concat fallback to avoid shell execution. If you want, I can produce a small patch for the missing import and convert the xfade command to subprocess-safe invocation.

Type: OpenClaw Skill Name: video-short-creator Version: 1.0.0 The skill bundle implements a legitimate video creation workflow using FFmpeg and edge-tts, but it contains high-risk coding patterns that could be exploited. Specifically, `scripts/step2_edit_video.py` uses `os.system()` to execute a complex command string, which is vulnerable to shell injection if file names or parameters are manipulated. Additionally, `scripts/step1_generate_review.py` uses `importlib` to dynamically execute a Python-based configuration file, creating a vector for arbitrary code execution. While these appear to be functional design choices for a local utility, they represent significant security vulnerabilities in an automated agent environment.