video-recreation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill makes remote HTTP requests to api.coze.cn and api.edata.cloud at runtime, neither of which is a recognized official publisher domain, representing an unauthorized external operational dependency.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). Upon analyzing the provided documentation and scripts, a high-entropy string is found hardcoded in scripts/coze_bot_client.py on line 310 (cztei_qHZQ0A5OSJjsmfZWmVb8bqu2BTbtB240YGbDYLhZpsIr8jER4aL4Aevyii8rnKfNs). This is a fully formed API key used as a default fallback value if none is provided via the environment. This represents a live credential leakage.