video-frame-extractor
视频反推工具,支持视频抽帧、视觉模型分析、提示词生成,适用于视频创作参考、内容提取、场景分析
60
70%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Fix and improve this skill with Tessl
tessl review fix ./skills/video-frame-extractor/video-frame-extractor/SKILL.mdSecurity
3 findings: 1 critical severity, 2 high severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The code embeds and/or defaults to a hardcoded third‑party API key and automatically encodes/uploads user images to external endpoints (api.coze.cn and configurable vision APIs), enabling unintended data exfiltration and use of the maintainer's account—an intentional backdoor/credential abuse pattern.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The prompt embeds a literal API key and instructs setting API keys as environment variables, which exposes a secret-like value that could be copied verbatim into outputs or commands.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I checked the documentation and scripts for literal, high-entropy credentials. The string "cztei_qHZQ0A5OSJjsmfZWmVb8bqu2BTbtB240YGbDYLhZpsIr8jER4aL4Aevyii8rnKfNs" is a long, random-looking API key (high entropy) and is hardcoded in both the SKILL.md example and in scripts/coze_bot_client.py as a default API_KEY. That meets the definition of a secret. I ignored placeholders like "your_api_key" and other example values (these are explicit documentation placeholders and not real secrets). The numeric Bot ID is an identifier (present as a default) but is not high-entropy; I did not treat it as the primary secret — the API key is the actual credential to flag.
- Repository
- anbeime/skill
- Commit
f595e96
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.