Claude Code, Skill
Html Explainer
把任意主题做成讲解/科普视频并渲染成 MP4（HTML/CSS/GSAP 画面 + 确定性逐帧渲染 + 配音 + 词级硬字幕）。触发场景：要做科普/讲解/教学/知识/产品类视频、「讲一下 X 做成视频」、要挑某种视觉风格（极简/数据/赛博/电影感/品牌）出片、要出抖音封面/竖版封面/9:16 封面、要用 html-video 那种模板化画面但更稳的音画同步、anything2explainer 换 HTML 渲染，或提到 html-explainer / HTML 讲解视频 / explainer video / MG 视频。内置 23 个模板风格（8
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
assets/gsap.min.js, line 10
!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?define(["exports"],e):e((t=t||self).window=t.window||{})}(this,
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/bench_render.py, line 122
os.remove(q)
scripts/bench_render.py, line 124
shutil.rmtree(q, ignore_errors=True)
scripts/bench_render.py, line 210
r = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", errors="replace")
Show more
scripts/blur_integrate.py, line 158
shutil.rmtree(d, ignore_errors=True)
scripts/blur_integrate.py, line 179
shutil.rmtree(tmp, ignore_errors=True)
scripts/blur_integrate.py, line 182
shutil.rmtree(shutter_root, ignore_errors=True)
scripts/blur_integrate.py, line 184
shutil.rmtree(tmp, ignore_errors=True)
scripts/frame_at.py, line 134
r = subprocess.run([ff, "-hide_banner", "-loglevel", "error", "-y", "-ss",
scripts/frame_at.py, line 140
os.remove(tmp)
scripts/new_project.py, line 143
r = subprocess.run(theme_args, capture_output=True, text=True, encoding="utf-8")
scripts/qc_check.py, line 42
r = subprocess.run([ff, "-hide_banner", "-i", path],
scripts/qc_check.py, line 56
r = subprocess.run([ff, "-hide_banner", "-i", path, "-af", "volumedetect",
scripts/qc_check.py, line 100
r = subprocess.run([ff, "-hide_banner", "-nostdin", "-progress", "pipe:1",
scripts/qc_check.py, line 116
r = subprocess.run([ff, "-hide_banner", "-loglevel", "error", "-y",
scripts/render_video.mjs, line 696
fs.rmSync(dir, { recursive: true, force: true });
scripts/timeline_build.py, line 36
r = subprocess.run([ff, "-hide_banner", "-i", path],
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
package_skill.py, line 40
".env", ".key", ".pem") # 密钥类：绝不进可分发包
scripts/check_integrity.py, line 17
6. 密钥防线：.gitignore 必须忽略 tts.env / *.env / *.key，且仓库内不得出现
scripts/check_integrity.py, line 227
a) .gitignore 覆盖 tts.env / *.env / *.key，且 tts.env.example 模板仍被跟踪；
Show more
scripts/check_integrity.py, line 233
need = ["tts.env", "*.env", "*.key"]
scripts/check_integrity.py, line 239
print(f"{OK} 密钥防线：.gitignore 已忽略 tts.env / *.env / *.key")
.gitignore, line 22
*.env
.gitignore, line 23
!*.env.example
CHANGELOG.md, line 730
③ `.gitignore` 新增 `tts.env` / `*.env` / `*.key` / `*.pem` / `secrets/`；
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
assets/gsap.min.js, line 10
!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?define(["exports"],e):e((t=t||self).window=t.window||{})}(this,
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit f52716b396fa. can delete files. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: f52716b396faffd72b921d89f8508b7c8a074ffc
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.