ai-director

SUSPICIOUS: 该技能总体目的与功能基本一致，确实围绕X2C短剧生成展开；但其最敏感的数据流把用户X2C API Key转发到未在文档中充分验证归属的Supabase端点，而非明确官方主域API，这是主要风险。再叠加本地持久化凭证、后台任务跟踪、Telegram/WebChat自动推送等能力，整体风险高于普通文档型技能。未见明确恶意载荷或下载执行链，因此更像高风险/可疑集成而非确认恶意。

This is a command-line automation script for generating and evaluating video content. It contains a significant command-injection vulnerability because prompt and style values are interpolated into execSync command strings. The risk is conditional on supplied arguments or evaluator output containing shell syntax; this fragment does not otherwise show clear malicious intent or data theft.