video-recreation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly shows and encourages embedding API keys as environment variables or direct command-line arguments (e.g., export SUNO_API_KEY and --suno-api-key), and mentions a pre-provisioned API key, which would require the LLM/agent or user to place secret values verbatim into commands or configs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code contains multiple intentional backdoor/abuse-friendly patterns: hard-coded/default API credentials that will be used if not supplied, automatic upload of user images to an external API, broad HTTP file serving (binds to all interfaces) exposing local files, and error-logging that can record function args/kwargs (risking secret leakage) — these are high-risk privacy/abuse patterns that could be (and appear to be) intentionally built into the skill.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). scripts/coze_bot_client.py makes a runtime POST to https://api.coze.cn/v3/chat to obtain analysis text that is saved and then used to drive the agent's prompt generation/decisions, so this external URL can directly control agent prompts at runtime.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal, high-entropy credentials. I found a long random-looking API key hardcoded in scripts/coze_bot_client.py. This string is not a placeholder (it is long, mixed-case, random-looking) and is assigned as a default API key in the script, which makes it a real embedded secret.

Ignored items:

• Numeric default Bot IDs (e.g., 7572557757883383858) — these are identifiers, low-sensitivity and not high-entropy access tokens.
• Example/truncated API keys in docs (e.g., sk_1234567890abcdef, sk_temp_key_12345, your_api_key) — documentation placeholders or examples per the ignore rules.