video-recap@1.0.22
VERIFIED· install onlyPublisher claims: "从输入视频一气呵成生成中文解说成片或原声剧情短片。用户提供 .mp4 / .mov / .mkv / .webm，并要求剪辑、添加旁白、配音、总结或制作短剧/电视剧/电影/纪录片/科普解说时使用。在同一个自包含技能内完成视频理解、导演立意与选镜剪辑、解说撰稿与校验、TTS 配音及音画混音合成。触发词：视频解说、视频旁白、生成解说、视频 recap、video recap、voiceover、narration、recap。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
Python subprocess execution detectedscripts/final_qc.py:131 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:248 · File type combined with upload action — agent may exfiltrate local data files
AST07"Inspect the edited storyboard first. Update `visual_audio_board.json` with OUTPUT ranges and re-assign `audio_owner` / `narration_job` based on the cut that actually exists.",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/recap_stage_qc.py:44 · File type combined with upload action — agent may exfiltrate local data files
AST07assembly_manifest.json only when that manifest rendered `final_output` (a staleFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/dashboard/runs.py:171 · File type combined with upload action — agent may exfiltrate local data files
AST07"""The video ``assembly_manifest.json`` binds as ``final_output``; never guessed by name."""Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/assemble.py:564 · File type combined with upload action — agent may exfiltrate local data files
AST07lib.log(f"组装完成: {final_output}")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:346 · File type combined with upload action — agent may exfiltrate local data files
AST07"你正在做多视频剪辑复盘。当前 MVP 只支持 `--edit-mode cut`：先做跨素材的故事与视听决定，再写 `clip_plan.json`；下一步会剪出 `edited_source.mp4`，最后按 OUTPUT 时间轴写 `narration.json`。",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/loudness.py:63 · Python subprocess execution detected
AST05result = subprocess.run(["ffmpeg", "-hide_banner", "-h", "filter=alimiter"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:254 · File type combined with upload action — agent may exfiltrate local data files
AST07"### narration.json shape (OUTPUT timestamps, 0..total)",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/export_jianying.py:49 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/final_qc.py:267 · File type combined with upload action — agent may exfiltrate local data files
AST07Only relayed when assembly_manifest.json says assemble.py rendered `final_output`:Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/final_qc.py:111 · Python subprocess execution detected
AST05res = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/sfx_mix.py:168 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/packaging_fonts.py:155 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/lib.py:403 · Python subprocess execution detected
AST05return subprocess.run(cmd, capture_output=True, text=True, **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:94 · File type combined with upload action — agent may exfiltrate local data files
AST07'你在解说块之间留出的原声留白，可通过 `original_subtitles.json` 把留白里真正听得到的原声台词烧成字幕（与解说字幕用 `「」` 区分）：按 OUTPUT 时间轴写成 `[{"start": 秒, "end": 秒, "text": "台词"}]`。',Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/sentence_boundaries.py:366 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsscripts/materials.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05first place — the key is read from the environment/``.env`` and never needs to beFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedscripts/recap_runtime.py:28 · Python subprocess execution detected
AST05res = subprocess.run(cmd, env={**os.environ, "PYTHONIOENCODING": "utf-8"})Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/lib.py:141 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/detect.py:80 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/recap_runtime.py:46 · Python subprocess execution detected
AST05res = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/recap_inspect.py:170 · File type combined with upload action — agent may exfiltrate local data files
AST07return ("narration.json", "pass2: 对着剪好的成片用 OUTPUT 时间轴写解说")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/lib.py:421 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionSKILL.md:107 · File type combined with upload action — agent may exfiltrate local data files
AST07…外侧；若属于**由本次拼接制造的切点**（如硬切边缘残留几帧隔壁镜头、碎反打），则外扩入出点或合并同源相邻片段，严禁靠塞转场遮丑。 写好 `clip_plan.json` 后重跑 `recap.py`，脚本会调用 `cut.py` 完成三步边界吸附（镜头硬切吸附 → 句末静音吸附与尾垫 → 帧网格对齐）、渲染恒定帧率 `edited_source.mp4` 并完成闪帧体检，再把 ASR、VLM 与句末锚点重映射到成片输出时间轴（`speech_boundary_anchor…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionSKILL.md:125 · File type combined with upload action — agent may exfiltrate local data files
AST07注意：**编排 `cut` 模式下，`narration.json` 必须直接填写剪后成片的 OUTPUT 时间戳（`0 .. 成片总时长`）**（单独调用校验器时传 `validate.py --mode cut_output`）。动笔时遵循九条核心写作铁律（详规与正反例见 `references/creative-editing-playbook.md`）：Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/assemble.py:591 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/recap_inspect.py:96 · File type combined with upload action — agent may exfiltrate local data files
AST07# 2. assembly_manifest.json — late stage; carries input_video (+ source_video in cut mode).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/assemble.py:407 · File type combined with upload action — agent may exfiltrate local data files
AST07lib.log(f"最终视频: {output_path} ({output_path.stat().st_size / 1024 / 1024:.1f}MB)")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:246 · File type combined with upload action — agent may exfiltrate local data files
AST07"## Cut mode — step 2 of 2: write `narration.json` in OUTPUT time",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/recap_inspect.py:12 · File type combined with upload action — agent may exfiltrate local data files
AST07clip-map read clip_plan_validated.json and map a queried OUTPUT window to its SOURCEFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/recap_runtime.py:79 · Python subprocess execution detected
AST05res = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/dashboard/runs.py:8 · File type combined with upload action — agent may exfiltrate local data files
AST07``assembly_manifest.json`` ``final_output`` and the cut stage's ``edited_source.mp4``.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/voiceover.py:621 · File type combined with upload action — agent may exfiltrate local data files
AST07# Cut mode is cut-first/narrate-second: narration.json is already on the outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/shot_review.py:167 · Python subprocess execution detected
AST05result = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/storyboard.py:63 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/shot_review.py:97 · Python subprocess execution detected
AST05result = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈3,083 tok
1 file · 121 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.