video-creation-suite

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The codebase includes hardcoded/embedded API credentials that will send user images to an external service under the developer's account, a file server bound to 0.0.0.0 exposing local outputs, and a dynamic import path that can load local (possibly untrusted) code — indicating high-risk intentional data exfiltration / credential misuse patterns.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill performs runtime calls to external model/analysis/generation endpoints (https://api.coze.cn/v3/chat, https://api.edata.cloud/v1/generate, https://api.openai.com/v1) whose textual responses are consumed and injected into the agent pipeline to drive visual analysis and generation, so these URLs are runtime dependencies that control prompts.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for hardcoded, high-entropy credentials. I found a long, random-looking API key literal hardcoded in scripts/coze_bot_client.py — this appears to be a real secret (not a placeholder) and is therefore flagged.

Ignored items:

• references/suno-api-guide.md examples like "export SUNO_API_KEY=sk_1234567890abcdef" and "sk_temp_key_12345" are documentation/example placeholders (low-entropy / clearly example-style) and are ignored per rules.
• Numeric default Bot IDs (e.g., "7572557757883383858") are identifiers, not secret keys, so ignored.

Location of the real secret:

• scripts/coze_bot_client.py contains the hardcoded API key string (high-entropy, usable credential).