video-recap@1.0.23
VERIFIED· install onlyPublisher claims: "从输入视频生成中文解说成片或原声剧情短片。用户提供 .mp4 / .mov / .mkv / .webm，并要求剪辑、添加旁白、配音、总结或制作短剧/电视剧/电影/纪录片/科普解说时使用。在同一个自包含技能内完成视频理解、导演立意与选镜剪辑、解说撰稿与校验、TTS 配音及音画混音合成。触发词：视频解说、视频旁白、生成解说、视频 recap、video recap、voiceover、narration、recap。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher worldwonderer · publishing for 43 daysInstalls 107Last detonated 27 min ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
Python subprocess execution detectedscripts/assemble.py:627 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/final_qc.py:111 · Python subprocess execution detected
AST05res = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:388 · File type combined with upload action — agent may exfiltrate local data files
AST07"先查看剪后故事板与上方保留片段映射，在 `visual_audio_board.json` 中补齐 OUTPUT 时间段并复核每拍的 `audio_owner` 与 `narration_job`。",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/dashboard/runs.py:193 · File type combined with upload action — agent may exfiltrate local data files
AST07"""The video ``assembly_manifest.json`` binds as ``final_output``; never guessed by name."""Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/lib.py:147 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:235 · File type combined with upload action — agent may exfiltrate local data files
AST07"解说块之间留出的原声对白，可通过 `original_subtitles.json` 烧录成字幕（与解说字幕以 `「」` 区分）：按成片 OUTPUT 时间轴写成 `[{\"start\": 秒, \"end\": 秒, \"text\": \"台词\"}]`。",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/lib.py:454 · Python subprocess execution detected
AST05return subprocess.run(cmd, capture_output=True, text=True, **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/assemble.py:429 · File type combined with upload action — agent may exfiltrate local data files
AST07lib.log(f"最终视频: {output_path} ({output_path.stat().st_size / 1024 / 1024:.1f}MB)")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionSKILL.md:107 · File type combined with upload action — agent may exfiltrate local data files
AST07写好 `clip_plan.json` 后重跑 `recap.py`，脚本完成边界吸附、渲染恒定帧率 `edited_source.mp4` 并重映射输出时间轴证据（`speech_boundary_anchors_output.json`、`storyboard/edited_storyboard.*`），随后暂停等待写解说词。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsscripts/materials.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05first place — the key is read from the environment/``.env`` and never needs to beFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedscripts/lib.py:488 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionSKILL.md:125 · File type combined with upload action — agent may exfiltrate local data files
AST07**编排 `cut` 模式下，`narration.json` 直接填写剪后成片的 OUTPUT 时间戳（`0 .. 成片总时长`）**（单独调校验器传 `validate.py --mode cut_output`）。核心写作要求（细则与正反例见 `references/creative-editing-playbook.md`）：Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/detect.py:80 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/dashboard/runs.py:8 · File type combined with upload action — agent may exfiltrate local data files
AST07``assembly_manifest.json`` ``final_output`` and the cut stage's ``edited_source.mp4``.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/final_qc.py:131 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:391 · File type combined with upload action — agent may exfiltrate local data files
AST07"### narration.json 格式（OUTPUT 成片时间戳，0..总时长）",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/assemble.py:587 · File type combined with upload action — agent may exfiltrate local data files
AST07lib.log(f"组装完成: {final_output}")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/final_qc.py:267 · File type combined with upload action — agent may exfiltrate local data files
AST07Only relayed when assembly_manifest.json says assemble.py rendered `final_output`:Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:484 · File type combined with upload action — agent may exfiltrate local data files
AST07"当前为多视频跨片源剪辑解说（通过 `--edit-mode cut` 跨源选段）：先完成跨素材的故事主线与声画设计，写出 `clip_plan.json`；下一步剪出 `edited_source.mp4` 后，再按成片 OUTPUT 时间轴写 `narration.json`。",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/briefing/builder.py:553 · File type combined with upload action — agent may exfiltrate local data files
AST07"先查看 `edited_source.mp4` 与下方成片保留片段映射，在 `visual_audio_board.json` 中补齐 OUTPUT 起止时间，并根据实际成片确认每拍的 `audio_owner`、原声锚点与 `narration_job`；若剪后顺序调整了主线推进，同步更新 `recap_story_plan.json`。",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/export_jianying.py:49 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/recap_runtime.py:48 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/recap_runtime.py:83 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/loudness.py:63 · Python subprocess execution detected
AST05result = subprocess.run(["ffmpeg", "-hide_banner", "-h", "filter=alimiter"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/storyboard.py:63 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/shot_review.py:97 · Python subprocess execution detected
AST05result = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/sentence_boundaries.py:409 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/recap_runtime.py:28 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/recap_stage_qc.py:44 · File type combined with upload action — agent may exfiltrate local data files
AST07assembly_manifest.json only when that manifest rendered `final_output` (a staleFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/voiceover.py:620 · File type combined with upload action — agent may exfiltrate local data files
AST07# Cut mode is cut-first/narrate-second: narration.json is already on the outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/recap_inspect.py:99 · File type combined with upload action — agent may exfiltrate local data files
AST07# 2. assembly_manifest.json — late stage; carries input_video (+ source_video in cut mode).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/sfx_mix.py:173 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/recap_inspect.py:173 · File type combined with upload action — agent may exfiltrate local data files
AST07return ("narration.json", "pass2: 对着剪好的成片用 OUTPUT 时间轴写解说")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/recap_inspect.py:12 · File type combined with upload action — agent may exfiltrate local data files
AST07clip-map read clip_plan_validated.json and map a queried OUTPUT window to its SOURCEFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/packaging_fonts.py:155 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/shot_review.py:167 · Python subprocess execution detected
AST05result = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈2,666 tok
1 file · 121 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.