tencent-vod@1.1.3
CAUTION· static onlyPublisher claims: "腾讯云 VOD（云点播）操作命令生成专用助手。只要用户的请求涉及 VOD 的任何具体操作，必须触发此 Skill，包括但不限于：【上传】本地视频/音频/图片上传、URL拉取上传到VOD、设置过期时间/SessionId去重/存储路径/按应用名上传；【媒体处理】转码/极速高清/截图/雪碧图/视频增强/真人增强/漫剧增强/短剧场景转码/电商场景转码/场景转码/转封装/remux/转为HLS/MP4/GIF/自适应码流/审核/任务流/procedure；【媒体查询】根据FileId查询媒体详情/转码信息/字幕/封面/元数据；【AIGC】文生图/文生视频/图生视频（Kling/Hunyuan/Vidu" Observed in sandbox: static analysis only — behavior not yet observed.
Registry ClawHubPublisher tencent-mpaas-skills · publishing for 162 daysInstalls 1,539Last detonated 5d ago
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-09 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyt+CategoryObserved action
This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
HIGH
Access to sensitive file pathsSKILL.md:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05配置示例（写入 `<SKILL_DIR>/.env`）：Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- `~/.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- `<SKILL_DIR>/.env` (`<SKILL_DIR>` 为本skill所在目录)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05必须在调用时（而非 import 时）读取环境变量：.env 的加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_task.py:954 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 先加载 .env，确保 argparse `default=os.environ.get(...)` 求值前环境变量已就绪Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_chat.py:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 提前触发 dotenv 加载，使下方 argparse 的默认值能从 ~/.env 等文件读取Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST051. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05get_credential() 内，若在模块级求值会早于 .env 加载，导致用户Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_video.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_video.py:551 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 但 .env 加载发生在 get_credential() 内，时序错位导致 SubAppId 为 None。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_chat.py:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_image.py:364 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 但 .env 加载发生在 get_credential() 内，时序错位导致 SubAppId 为 None。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_task.py:956 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 但 .env 加载发生在 get_credential() 内，时序错位导致 SubAppId 为 None。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_media.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05必须在调用时（而非 import 时）读取环境变量：.env 的加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_scene_aigc_video_task.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_media.py:563 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_media.py:564 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05dotenv_path: .env 文件路径Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:369 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_audio.py:344 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 先加载 .env，确保 argparse `default=os.environ.get(...)` 求值前环境变量已就绪Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_image.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_audio.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_scene_aigc_video_task.py:380 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05导致用户在 .env 中配置的 TENCENTCLOUD_REGION 被忽略。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:565 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 但 .env 加载发生在 get_credential() 内，时序错位导致 SubAppId 为 None。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_media.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_task.py:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_aigc_advanced_custom_element.py:563 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 先加载 .env，确保 argparse `default=os.environ.get(...)` 求值前环境变量已就绪Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_audio.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_scene_aigc_video_task.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_video.py:549 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 先加载 .env，确保 argparse `default=os.environ.get(...)` 求值前环境变量已就绪Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_task.py:131 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05在 .env 中配置的 TENCENTCLOUD_REGION 被忽略。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_create_scene_aigc_video_task.py:381 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST053. ./.env （当前工作目录 dotenv）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_image.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST052. ~/.env （用户级 dotenv，最高优先级）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_describe_sub_app_ids.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_video.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_import_media_knowledge.py:370 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_token.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05main() / get_credential() 内，若在模块级求值会早于 .env 加载，Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_aigc_image.py:362 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 先加载 .env，确保 argparse `default=os.environ.get(...)` 求值前环境变量已就绪Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_scene_aigc_image.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:586 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:1324 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_scene_aigc_image.py:429 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:524 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 先加载 .env，确保 argparse `default=os.environ.get(...)` 求值前环境变量已就绪Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_scene_aigc_image.py:428 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_upload.py:503 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_process_image.py:526 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 但 .env 加载发生在 get_credential() 内，时序错位导致 SubAppId 为 None。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_upload.py:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedscripts/vod_auto_upgrade.py:65 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsscripts/vod_process_media.py:1325 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:364 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_pull_upload.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media_by_semantics.py:365 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_pull_upload.py:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_pull_upload.py:361 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_scene_aigc_image.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_upload.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 软依赖：vod_load_env 用于在凭证缺失时从 ~/.env 等 dotenv 文件兜底加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_pull_upload.py:360 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_load_env.py:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""从 cwd 向上递归查找 .env 文件。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 兜底：尝试从 ~/.env 等 dotenv 文件加载Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_search_media.py:585 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 早加载 .env，确保 argparse `default=os.environ.get(...)` 能取到 TENCENTCLOUD_VOD_SUB_APP_IDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/vod_upload.py:504 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 修复 BUG：此前 argparse 在 add_argument 时立即从环境变量取值，但 .env 加载发生在Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈5,337 tok
1 file · 42 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim tencent-mpaas-skills: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim tencent-mpaas-skillsPropose a patch to the maintainer