Claude Code, Plugin
playbook
智码航工具集,全程零猜测。提示词三件套——prompt-optimizer:消歧→两道选择题→纯拼接,把一句模糊的话理成可直接发送的提示词;five-sentence-brief:按五句话把一件要办的事补全成任务简报;four-part-prompt:按目标/背景/输出要求/边界约束四段补全成结构化提示词。视频——digital-human-video:确认后调用火山·即梦AI 产出口播视频;digital-human-video-init:配置密钥并零成本验证;zmh-short-video-pipeline:按文案确认与音频、成片发布包、三平
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit f78233991d8e.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
skills/digital-human-video/scripts/aigc_meta.py, line 82
result = subprocess.run( - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
skills/digital-human-video/scripts/jimeng_dh.py, line 71
with urllib.request.urlopen(req, timeout=60) as r: - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
skills/digital-human-video/scripts/gen_scene.py, line 23
DEFAULT_T2I = os.environ.get("DHV_T2I_REQ_KEY", "jimeng_t2i_v40")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/digital-human-video/scripts/aigc_meta.py, line 82
result = subprocess.run(
skills/digital-human-video/scripts/aigc_selftest.py, line 78
result = subprocess.run(["ffmpeg", "-nostdin", "-v", "error", "-y", *args],
skills/digital-human-video/scripts/aigc_selftest.py, line 127
raw = subprocess.run(["ffmpeg", "-v", "error", "-i", str(video), "-vf", f"format=gray,crop={w}:{h}:{x}:{y}",
Show more
skills/digital-human-video/scripts/aigc_selftest.py, line 139
out = subprocess.run(["ffmpeg", "-v", "error", "-i", str(path), "-map", "0:v:0", "-fps_mode", "passthrough",
skills/digital-human-video/scripts/aigc_selftest.py, line 152
return subprocess.run([sys.executable, str(HERE / "aigc_meta.py"), *args], capture_output=True, text=True, check=False)
skills/digital-human-video/scripts/aigc_selftest.py, line 168
result = subprocess.run([sys.executable, str(VERIFY), "--video", str(video), *extra],
skills/digital-human-video/scripts/aigc_selftest.py, line 196
old_cli = subprocess.run([sys.executable, str(HERE / "render_text.py"), "badge", str(tmp / "x.png")],
skills/digital-human-video/scripts/aigc_selftest.py, line 276
cli = subprocess.run([sys.executable, str(HERE / "render_text.py"), "badge", str(tmp / f"cli_{anchor}.png"),
skills/digital-human-video/scripts/aigc_selftest.py, line 979
shutil.rmtree(tmp, ignore_errors=True)
skills/digital-human-video/scripts/compose_selftest.py, line 146
shutil.rmtree(tmp, ignore_errors=True)
skills/digital-human-video/scripts/jimeng_dh.py, line 156
if os.path.exists(sidecar): os.remove(sidecar) # 完成即清,免得下次误续跑
skills/digital-human-video/scripts/jimeng_video.py, line 102
os.remove(sidecar)
skills/digital-human-video/scripts/make_cover.py, line 109
os.remove(tmp)
skills/digital-human-video/scripts/tts.py, line 79
os.remove(mp3)
skills/digital-human-video/scripts/tts.py, line 88
os.remove(aiff)
skills/zmh-short-video-pipeline/scripts/pipeline_defaults_selftest.py, line 145
shutil.rmtree(tmp, ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
skills/digital-human-video/scripts/jimeng_dh.py, line 71
with urllib.request.urlopen(req, timeout=60) as r:
skills/digital-human-video/scripts/tts.py, line 46
with urllib.request.urlopen(req, timeout=60) as r:
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
skills/digital-human-video/scripts/gen_scene.py, line 23
DEFAULT_T2I = os.environ.get("DHV_T2I_REQ_KEY", "jimeng_t2i_v40")
skills/digital-human-video/scripts/gen_scene.py, line 48
a.req_key = os.environ.get("DHV_I2I_REQ_KEY", "jimeng_i2i_v30")
skills/digital-human-video/scripts/jimeng_dh.py, line 26
return os.environ.get("DHV_REQ_KEY") or DEFAULT_REQ_KEY
Show more
skills/digital-human-video/scripts/jimeng_video.py, line 38
return os.environ.get("DHV_VIDEO_REQ_KEY") or DEFAULT_REQ_KEY
skills/digital-human-video/scripts/tts.py, line 120
use_doubao = bool(os.environ.get("TTS_APPID") and os.environ.get("TTS_TOKEN"))
skills/digital-human-video-init/scripts/validate.py, line 46
if not (os.environ.get("TTS_APPID") and os.environ.get("TTS_TOKEN")):
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Note
no licence file found.
LICENCE_MISSING
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit f78233991d8e. can delete files. can reach a host that is not written as a fixed address. reads an environment variable. no licence file found.
Date and source
Date checked:
github.com
Commit graded: f78233991d8e3d28c6df09cc6c21ac18f4e6de1e
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.