Claude Code, Skill
Creator Pipeline
Creator Pipeline, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 2b7e649d99e7, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
examples/live-demo/presentation/scripts/prepare-vercel.mjs, line 11
fs.rmSync(output,{recursive:true,force:true}); - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
examples/live-demo/presentation/scripts/tts-providers/openai.sh, line 16
if ! command -v curl >/dev/null; then - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
examples/live-demo/presentation/scripts/tts-providers/openai.sh, line 16
if ! command -v curl >/dev/null; then - SECRETS_PATH_DOTENV Low
Mentions a .env file.
.gitignore, line 10
.env - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
skills/voice-clone-tts/scripts/clone-minimax.py, line 20
key = config.get('api_key') or os.environ.get('MINIMAX_API_KEY') - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
examples/live-demo/presentation/public/audio/voiceover.wav, line 1
RIFFZ\ WAVEfmt �] �� data6\ ������������������������������������������������������������������������
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
examples/live-demo/presentation/scripts/prepare-vercel.mjs, line 11
fs.rmSync(output,{recursive:true,force:true});
examples/live-demo/presentation/scripts/verify-export.py, line 14
return subprocess.check_output(args)
scripts/check-package.py, line 21
names=subprocess.check_output(['git','ls-files','--cached','--others','--exclude-standard'],cwd=ROOT,text=True,stderr=subprocess.DEVNULL).splitlines()
Show more
skills/voice-clone-tts/scripts/build.py, line 69
subprocess.run(['ffmpeg', '-v', 'error', '-nostdin', '-i', str(master), '-c:a', 'libmp3lame',
skills/voice-clone-tts/scripts/build.py, line 72
decoded = subprocess.run(['ffmpeg', '-v', 'error', '-nostdin', '-i', str(mp3), '-f', 's16le',
skills/voice-clone-tts/scripts/clone-minimax.py, line 48
duration = float(subprocess.check_output(['ffprobe', '-v', 'error', '-show_entries',
skills/voice-clone-tts/scripts/common.py, line 49
subprocess.run(['ffmpeg', '-v', 'error', '-nostdin', '-i', str(source), '-vn', '-ac', '1',
skills/voice-clone-tts/scripts/providers.py, line 137
subprocess.run(['mmx', 'speech', 'synthesize', '--text', text, '--voice', s['voice'],
skills/voice-clone-tts/scripts/run.py, line 27
subprocess.run([sys.executable, str(scripts / name), *map(str, extra)], check=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach texttospeech.googleapis.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
examples/live-demo/presentation/scripts/tts-providers/openai.sh, line 16
if ! command -v curl >/dev/null; then
examples/live-demo/presentation/scripts/tts-providers/openai.sh, line 17
echo "✗ curl not found in PATH." >&2
examples/live-demo/presentation/scripts/tts-providers/openai.sh, line 40
curl - brew install curl / apt-get install curl
Show more
examples/live-demo/presentation/scripts/tts-providers/openai.sh, line 63
# On HTTP error curl with -f exits non-zero, runner marks FAILED.
examples/live-demo/presentation/scripts/tts-providers/openai.sh, line 66
curl -fsS -o "$out" -X POST "$base/audio/speech" \
examples/live-demo/presentation/src/export/raster.ts, line 13
const res = await fetch(absolute, { signal });
examples/live-demo/presentation/src/export/raster.ts, line 39
if (!cssFiles.has(url)) cssFiles.set(url, fetch(url, { signal }).then(async res => {
skills/voice-clone-tts/scripts/clone-minimax.py, line 33
with urllib.request.urlopen(req, timeout=120) as response:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/voice-clone-tts/scripts/clone-minimax.py, line 20
key = config.get('api_key') or os.environ.get('MINIMAX_API_KEY')
.gitignore, line 9
*.tsbuildinfo
.gitignore, line 10
.env
Show more
.gitignore, line 12
!.env.example
examples/live-demo/presentation/scripts/tts-providers/README.md, line 92
> 同目录放一个 git-ignored 的 `.env` 文件并 `set -a; source .env; set +a`。
skills/web-video-presentation/references/AUDIO.md, line 261
| `OPENAI_API_KEY is not set` | `export OPENAI_API_KEY=sk-...`，或者把它加到 shell rc / `.env` |
skills/web-video-presentation/references/AUDIO.md, line 271
| `<X>_API_KEY not set` | 你的 provider 需要 API key，但 env 里没设。`export <X>_API_KEY=...` 或写到 `.env` 再 `set -a; source .env; set +a` |
skills/web-video-presentation/templates/scripts/tts-providers/README.md, line 92
> 同目录放一个 git-ignored 的 `.env` 文件并 `set -a; source .env; set +a`。
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
examples/live-demo/presentation/public/audio/voiceover.wav, line 1
RIFFZ\ WAVEfmt �] �� data6\ ������������������������������������������������������������������������
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 2b7e649d99e7. can delete files. can reach a host that is not written as a fixed address. can reach texttospeech.googleapis.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 2b7e649d99e78f9e61985f3e86f192d6d75591f8
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.