video-recreation
完整的视频二创工具，支持视频反推、素材生成(图片/音效/背景音乐/配音/字幕)、视频合成、文件下载的全流程，集成Coze Bot API进行视觉分析，使用Edge-TTS进行语音合成
61
72%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Fix and improve this skill with Tessl
tessl review fix ./skills/video-recreation/video-recreation/SKILL.mdSecurity
3 findings: 1 critical severity, 2 high severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The code contains multiple intentional backdoor/abuse-friendly patterns: hard-coded/default API credentials that will be used if not supplied, automatic upload of user images to an external API, broad HTTP file serving (binds to all interfaces) exposing local files, and error-logging that can record function args/kwargs (risking secret leakage) — these are high-risk privacy/abuse patterns that could be (and appear to be) intentionally built into the skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill explicitly shows and encourages embedding API keys as environment variables or direct command-line arguments (e.g., export SUNO_API_KEY and --suno-api-key), and mentions a pre-provisioned API key, which would require the LLM/agent or user to place secret values verbatim into commands or configs.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I scanned the repository for literal, high-entropy credentials. I found a long random-looking API key hardcoded in scripts/coze_bot_client.py. This string is not a placeholder (it is long, mixed-case, random-looking) and is assigned as a default API key in the script, which makes it a real embedded secret. Ignored items: - Numeric default Bot IDs (e.g., 7572557757883383858) — these are identifiers, low-sensitivity and not high-entropy access tokens. - Example/truncated API keys in docs (e.g., sk_1234567890abcdef, sk_temp_key_12345, your_api_key) — documentation placeholders or examples per the ignore rules.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
scripts/coze_bot_client.py makes a runtime POST to https://api.coze.cn/v3/chat to obtain analysis text that is saved and then used to drive the agent's prompt generation/decisions, so this external URL can directly control agent prompts at runtime.
- Repository
- anbeime/skill
- Commit
f595e96
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.