Claude Code, Skill
video2knowledge
video2knowledge, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
scripts/setup_models.sh, line 122
log " Linux/macOS: curl -fsSL https://ollama.com/install.sh | sh"
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/asr_caption.py, line 76
out = subprocess.run([sys.executable, str(HP), "--key", key],
scripts/asr_caption.py, line 112
subprocess.run(
scripts/asr_caption.py, line 296
out = subprocess.run(
Show more
scripts/asr_caption.py, line 305
proc = subprocess.run(
scripts/asr_caption.py, line 338
subprocess.run(
scripts/asr_caption.py, line 472
shutil.rmtree(tmp, ignore_errors=True) # success: drop the chunk cache
scripts/asr_funasr.py, line 126
subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", "-y",
scripts/batch_run.py, line 214
r = subprocess.run(cmd, stdout=lf, stderr=subprocess.STDOUT)
scripts/batch_run.py, line 222
r = subprocess.run(cmd, stdout=lf, stderr=subprocess.STDOUT)
scripts/extract_frames.py, line 566
shutil.rmtree(args.out_dir)
Install and update
Serious
install fetches a script from the network.
INSTALL_REMOTE_SCRIPT
scripts/setup_models.sh, line 122
log " Linux/macOS: curl -fsSL https://ollama.com/install.sh | sh"
requirements.txt, line 2
faster-whisper>=1.0.3
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
scripts/asr_caption.py, line 365
with urllib.request.urlopen(req, timeout=300) as r:
scripts/build_knowledge.py, line 188
with urllib.request.urlopen(req, timeout=timeout) as r:
scripts/build_knowledge.py, line 203
with urllib.request.urlopen(f"{host}/api/tags", timeout=10) as r:
Show more
scripts/build_knowledge.py, line 315
with urllib.request.urlopen(req, timeout=1800) as r:
scripts/build_knowledge.py, line 1376
f"(curl {args.host}/api/tags)? On a reachable-but-empty model "
scripts/build_notes.py, line 75
with urllib.request.urlopen(req, timeout=timeout) as r:
scripts/build_notes.py, line 100
with urllib.request.urlopen(req, timeout=30) as r:
scripts/build_notes.py, line 181
with urllib.request.urlopen(req, timeout=240) as r:
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
scripts/asr_caption.py, line 582
default=os.environ.get("ASR_API_KEY_ENV") or "OPENAI_API_KEY",
scripts/asr_caption.py, line 586
f"every log line). Default {os.environ.get('ASR_API_KEY_ENV') or 'OPENAI_API_KEY'}; "
scripts/build_knowledge.py, line 1162
ap.add_argument("--api-key-env", default=os.environ.get("V2K_LLM_API_KEY_ENV",
Show more
scripts/build_notes.py, line 587
ap.add_argument("--api-key-env", default=os.environ.get("V2K_LLM_API_KEY_ENV",
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit b56a74855f9f. can delete files. install fetches a script from the network. can reach a host that is not written as a fixed address. reads an environment variable.
Date and source
Date checked:
github.com
Commit graded: b56a74855f9f421838478b56ff3a7f574ad13825
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.