Skills/ClawHub/tencent-mps

tencent-mps@1.3.2

VERIFIED· install only

Publisher claims: "腾讯云 MPS 音视频与图片处理、AI 生成、内容理解。涉及以下场景必须触发：【转码】转码/压缩/格式转换/转封装/H.264/H.265/AV1/码率/分辨率。【画质增强】画质增强/画质修复/老片修复/超分/真人增强/漫剧增强/防抖/人脸保真/1080P/2K/4K。【音频】音频分离/人声提取/伴奏提取/去人声/降噪/音量均衡。【字幕】字幕提取/字幕翻译/语音识别/语音转文字/ASR/OCR字幕/SRT/视频翻译。【擦除】去字幕/去水印/人脸模糊/车牌模糊/马赛克。【配音】语音合成/TTS/文字转语音/AI配音/配音/声音克隆/音色复刻。【图增强】图片超分/美颜/降噪/色彩增强/低光照增强。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher tencent-mpaas-skills · publishing for 162 daysInstalls 676Last detonated 5d ago
$clawhub install tencent-mps
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsscripts/mps_erase.py:226 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_comprehend.py:129 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_doc_to_video.py:643 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_get_video_task.py:145 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_bg_fusion.py:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_aigc_video.py:518 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_changemodel.py:425 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_aigc_audio.py:182 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_enhance.py:293 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_dubbing.py:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_doc_to_video.py:273 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_aigc_audio.py:169 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files如果变量没有配置，明确提醒用户在 `~/.env`（用户级 dotenv，最高优先级）或 `<SKILL_DIR>/.env`（脚本目录级）或 `~/.bashrc` 或 `~/.profile` 自己配置，禁止向用户索取密钥帮用户配置。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_bg_fusion.py:127 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_comprehend.py:142 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_changemodel.py:146 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_aigc_image.py:403 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_aigc_video.py:505 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_dubbing.py:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 早于 ensure_env_loaded() 加载 .env，会导致国际站配置失效；Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_get_video_task.py:132 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_highlight.py:213 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_get_image_task.py:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_dubbing.py:201 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_dubbing.py:225 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 在 main 中才执行，导致 .env 里配置的国际站 endpoint 静默失效。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_highlight.py:200 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_doc_to_video.py:286 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_erase.py:239 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_get_image_task.py:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_bg_fusion.py:430 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_changemodel.py:133 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_aigc_image.py:390 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_enhance.py:306 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_transcode.py:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_transcode.py:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_narrate.py:170 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_tryon.py:152 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_comprehend.py:400 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_cutout.py:131 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_poster_suite.py:156 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_usage.py:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_subtitle.py:229 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_orientation_convert.py:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_poster_suite.py:611 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_usage.py:119 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_poster_suite.py:169 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_imageprocess.py:245 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_detect.py:162 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_padding.py:130 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_narrate.py:157 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_qualitycontrol.py:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_split.py:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_imageprocess.py:258 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_detect.py:457 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_split.py:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_padding.py:383 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_detect.py:149 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_split.py:378 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_repaint.py:138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesos.path.expanduser("~/.env"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_subtitle.py:242 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_qualitycontrol.py:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_cutout.py:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_multiview.py:159 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_tryon.py:454 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. ~/.env （用户级 dotenv）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_orientation_convert.py:191 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_multiview.py:403 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_repaint.py:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_cutout.py:375 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_poll_task.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files行为与各业务脚本的 get_credentials() 保持一致：凭证可能只写在 ~/.env 等Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_poll_task.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_multiview.py:146 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_poll_task.py:670 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 借助 find_dotenv(usecwd=True) 从当前工作目录向上递归查找最近的 .env 文件并加载。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_padding.py:143 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"请在 ~/.env、~/.bashrc、~/.profile 或 <SKILL_DIR>/.env 中添加这些变量。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files5. <SKILL_DIR>/.env （脚本所在 skill 目录的 dotenv）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_tryon.py:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 凭证可能写在 ~/.env 等 dotenv 文件中而未导出，先尝试加载再重试Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_image_repaint.py:397 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 时序修复：先加载 .env，让 argparse default=os.environ.get(...) 能读到用户配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/mps_auto_upgrade.py:113 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈5,128 tok
1 file · 75 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.