tencent-vod-intl@1.1.3
CAUTION· static onlyPublisher claims: "Tencent Cloud VOD (Video on Demand) command generation assistant. Must trigger whenever the user's request involves any VOD operation: [Upload] local/URL pull upload, expiration/SessionId/storage path; [Media Processing] transcode/TESHD/screenshot/sprite/enhance/real-person/drama/scene/remux/HLS/GIF" Observed in sandbox: static analysis only — behavior not yet observed.
Registry ClawHubPublisher tencent-mpaas-skills · publishing for 162 daysInstalls 1,443Last detonated 5d ago
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-09 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyt+CategoryObserved action
This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env loading happens inside get_credential(), so evaluating this atFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_task.py:128 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_video.py:546 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so that `argparse default=os.environ.get(...)` sees the values.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:553 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so that `argparse default=os.environ.get(...)` sees the values.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_media.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_media.py:562 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:555 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# but .env was loaded inside get_credential() — too late, causing SubAppId=None.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_media.py:563 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05module level would run before .env is loaded and silently ignore aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_scene_aigc_video_task.py:371 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env is used as a fallback to load credentials from ~/.env etc. when env vars are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env is used as a fallback to load credentials from ~/.env etc. when env vars are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# TENCENTCLOUD_REGION from .env is already in os.environFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:365 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_video.py:548 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# but .env was loaded inside get_credential() — too late, causing SubAppId=None.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_audio.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env, used to fall back to loading from ~/.env or other dotenv files when credentials are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- `<SKILL_DIR>/.env` (`<SKILL_DIR>` is the directory of this skill)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_audio.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load from ~/.env or other dotenv filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_scene_aigc_video_task.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_image.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_image.py:356 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# but .env was loaded inside get_credential() — too late, causing SubAppId=None.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env is used as a fallback to load credentials from ~/.env etc. when env vars are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_chat.py:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env provides fallback loading from ~/.env when credentials are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05at module level would run before .env is loaded and silently ignore aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_task.py:956 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# but .env was loaded inside get_credential() — too late, causing SubAppId=None.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_task.py:954 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so that `argparse default=os.environ.get(...)` sees the values.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_audio.py:344 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env first, ensuring env vars are ready before argparse `default=os.environ.get(...)` is evaluatedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- `~/.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_chat.py:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Trigger dotenv loading early so argparse default values can be read from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env loading happens inside main() / get_client(), so evaluating thisFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Configuration example (write to `<SKILL_DIR>/.env`):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_scene_aigc_video_task.py:372 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# TENCENTCLOUD_REGION from .env is already in os.environFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_video.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_image.py:354 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so that `argparse default=os.environ.get(...)` sees the values.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:585 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:1339 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedscripts/vod_auto_upgrade.py:66 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:366 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_pull_upload.py:353 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:366 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_scene_aigc_image.py:420 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env is used as a fallback to load credentials from ~/.env etc. when env vars are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:1340 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env is used as a fallback to load credentials from ~/.env etc. when env vars are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST052. ~/.env (user-level dotenv, highest priority)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_pull_upload.py:352 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_upload.py:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_upload.py:498 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env is used as a fallback to load credentials from ~/.env etc. when env vars are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:584 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05dotenv_path: path to the .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_scene_aigc_image.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_upload.py:499 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05from the current directory for the nearest .env file and loads it.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:367 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# BUG FIX: argparse evaluates default at add_argument time, but .env was previouslyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Supports common syntax (covers 99% of real .env files):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Soft dependency: vod_load_env is used as a fallback to load credentials from ~/.env etc. when env vars are missingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST053. ./.env (current working directory dotenv)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_scene_aigc_image.py:419 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so argparse `default=os.environ.get(...)` can read TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:523 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env early so that `argparse default=os.environ.get(...)` sees the values.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_pull_upload.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fallback: try to load credentials from ~/.env etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:525 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# but .env was loaded inside get_credential() — too late, causing SubAppId=None.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈9,122 tok
1 file · 42 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim tencent-mpaas-skills: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim tencent-mpaas-skillsPropose a patch to the maintainer