video-recreation

SUSPICIOUS. The skill’s core video-processing behavior is mostly aligned with its purpose, and its Coze integration uses the official service endpoint. However, it embeds a hardcoded Coze API key and forwards optional Suno credentials to a third-party gateway (api.edata.cloud) instead of an official Suno API, creating significant credential-handling and data-flow concerns.

This module is a client for sending prompts and optional base64-encoded local images to an external chat API and returning/parsing descriptions. The main supply-chain/security red flag is the presence of hardcoded fallback credentials (including an API key) in main(), which can enable unauthorized use and accidental exposure of the maintainer’s credentials. Beyond that, it intentionally exfiltrates local image contents and user prompts to a third-party endpoint and may leak server error/response details via exceptions and console output. No clear malware primitives are present in the provided fragment, but the credential anomaly and data-sharing behavior warrant careful review and secret rotation.

No explicit malicious functionality is evident in this module: it primarily performs audio generation (remote API + polling + download) or local WAV synthesis, and it does not include backdoors, command execution, or obvious data theft. However, it presents moderate operational security risk due to (1) unsafe filename construction from untrusted title/name values (potential path traversal/overwrite), and (2) unvalidated downloading from audio_url returned by a remote API (potential SSRF-like behavior if the upstream response can be influenced). Additional review is recommended for the unseen retry/logger components and to harden filename sanitization, URL allowlisting, and logging practices.