Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Sansheng Gemini Video

Use when 用户要用 Gemini 原生多模态联合分析本地或在线视频的画面、声音与时序，支持 YouTube 直读，以及按需下载 B站、小红书、抖音或经一次性授权解析微信视频号；触发词：分析视频、录屏质检、视频链接分析、批量验收。只要字幕、只下载、或要剪辑出片（交给 sandy-video）时不用此 Skill。

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 5a8e9c534ab5, unchanged since the check below.

NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED

Why this grade

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    scripts/analyze_video.py, line 369 r = requests.post(url, json=body, timeout=300)

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    scripts/analyze_video.py, line 30 # ---------- .env 兜底加载(环境变量优先;仅本进程内存读取,绝不写盘/打印)----------

  • PERMISSION_SHELL_DECLARED Note

    Runs shell commands, and the manifest or description says so.

    scripts/analyze_video.py, line 174 subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    scripts/analyze_video.py, line 174

    subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

    scripts/analyze_video.py, line 204

    subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

    scripts/source_resolver.py, line 170

    runner: Callable[..., Any] = subprocess.run,

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    scripts/analyze_video.py, line 369

    r = requests.post(url, json=body, timeout=300)

    scripts/setup_check.py, line 95

    with socket.create_connection((parsed.hostname, parsed.port or 80), timeout=0.3):

    scripts/source_resolver.py, line 237

    response = requests.post(

    Show more

    scripts/source_resolver.py, line 286

    with requests.get(

    scripts/source_resolver.py, line 391

    parsed_response = requests.post(

    scripts/source_resolver.py, line 429

    feed_response = requests.post(

    scripts/source_resolver.py, line 520

    response = requests.get(api_base.rstrip("/") + "/api/status", timeout=2)

    scripts/source_resolver.py, line 537

    response = requests.post(endpoint, json={"url": url, "mp3": False, "cover": False}, timeout=30)

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    scripts/analyze_video.py, line 30

    # ---------- .env 兜底加载(环境变量优先;仅本进程内存读取,绝不写盘/打印)----------

    scripts/analyze_video.py, line 31

    # .env 兜底位置:本 skill 目录、当前工作目录。所有配置(含 GEMINI_VERTEX_PROJECT)都可写进 .env,

    scripts/analyze_video.py, line 32

    # 不必非得设成 shell 环境变量 -- 与 .env.example 的承诺保持一致。

    Show more

    scripts/analyze_video.py, line 33

    _ENV_FILES = (Path(__file__).resolve().parent.parent / ".env", Path.cwd() / ".env")

    scripts/analyze_video.py, line 37

    """把 .env 兜底位置解析成 dict(先出现的文件优先)。绝不写盘、绝不打印值。"""

    scripts/analyze_video.py, line 57

    """读配置:环境变量优先,其次 .env 兜底,再默认。(API key 不走这里,见 load_key。)"""

    scripts/analyze_video.py, line 64

    # ---------- 配置(单一来源;环境变量优先,其次 .env,再默认)----------

    scripts/analyze_video.py, line 66

    VERTEX_PROJECT = _cfg("GEMINI_VERTEX_PROJECT") # GCP 项目 ID(仅 Vertex Express key 需要;可写进 .env)

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 5a8e9c534ab5. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: 5a8e9c534ab51c2766c405420cc68710665acc57

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen