multi-platform-video-director@1.0.1
VERIFIED· install onlyPublisher claims: "多平台生成视频导演技能。将一张或多张参考图片或文字描述转化为可执行的视频方案、平台适配 Prompt、负向 Prompt、分镜设计、运动参数，并在有可用视频生成工具时直接生成视频。适用于：图生视频、文生视频、图片转视频、海报动效、首尾帧视频、产品展示动画、人物照片动态化、节日宣传视频、社交媒体短视频、电影感镜头运动、视频配乐、语气词配音、字幕叠加、多镜头拼接，以及提到 Runway、Kling/可灵、即梦/Jimeng、Higgsfield、Pika、Luma、Hailuo/海螺、Veo 等平台的请求。根据画面内容与用户目标自动选择或排序平台，不强制指定单一提供商。注意：本技能仅处理视频生成，不处理图片生成（用 ImageGen）、3D模型或模板特效（用3D模型与视频特效技能）。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 90/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
r = subprocess.run([ffmpeg, "-i", path], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.r = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.r = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.r = subprocess.run([ffmpeg, "-i", path], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.r = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.