Skills/ClawHub/tencent-mps-video-dubbing

tencent-mps-video-dubbing@1.0.6

VERIFIED· install only

Publisher claims: "Tencent Cloud MPS 一站式端到端视频译制专用 Skill，在单次任务中**不可拆分**地完成「提取原视频语音/字幕 → 翻译为目标语言 → 压制目标语言字幕 → AI 克隆原声配音」整条跨语言本地化流水线。**触发的硬条件（必须同时满足）：(1) 用户的输入是一段视频；(2) 明确要求变更音视频的语言（翻译 + 配音 / 翻译 + 换语言 / 做成另一语言版本）；(3) 是端到端产出一个全新语言版本的视频，而不是只做流水线中的某一步子任务**。满足硬条件的典型表达：把这段视频翻译成英文并配音、中文视频做成韩语版、韩剧中配、短剧出海译制、做一个日语配音版、 跨语言视频制作" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher tencent-mpaas-skills · publishing for 162 daysInstalls 1,107Last detonated 4d ago
$clawhub install tencent-mps-video-dubbing
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsSKILL.md:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files如果变量没有配置，明确提醒用户在 `~/.env`（用户级 dotenv，最高优先级）或 `<SKILL_DIR>/.env`（脚本目录级）或 `~/.bashrc` 或 `~/.profile` 自己配置，禁止向用户索取密钥帮用户配置。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. ~/.env （用户级 dotenv）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files5. <SKILL_DIR>/.env （脚本所在 skill 目录的 dotenv）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 借助 find_dotenv(usecwd=True) 从当前工作目录向上递归查找最近的 .env 文件并加载。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/mps_video_dubbing.py:793 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 自动加载 /root/.env 之类Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/mps_auto_upgrade.py:113 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/mps_load_env.py:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesos.path.expanduser("~/.env"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈2,005 tok
1 file · 12 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.