Codex, Plugin
Muzhi Video Studio
你可以从一个视频想法开始，也可以带着已经确认的口播来制作。同一个 Codex 工作室有两个主入口：content-planning 陪你讨论题目、受众、平台、观点和说话方式，稿子确认后再交给 video-production 处理本人录音、字幕、导演和画面。讨论可以反复修改，制作会保留原件和已批准版本；事实、表达和最后好不好看，仍由你一起把关。
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_SHELL_UNDECLARED OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- PERMISSION_SHELL_UNDECLARED Medium
Runs shell commands that the manifest or description does not mention.
plugins/muzhi-video-studio/scripts/local_h3_adapter.py, line 75
return subprocess.run(args, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout, check=False) - OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
plugins/muzhi-video-studio/assets/shotcraft/full-index.json, line 1
{
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
requests shell access. No manifest field names shell or command execution. can delete files.
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
plugins/muzhi-video-studio/scripts/local_h3_adapter.py, line 75
return subprocess.run(args, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout, check=False)
plugins/muzhi-video-studio/scripts/narration_track.py, line 122
process = subprocess.run([ffmpeg, "-nostdin", "-hide_banner", "-loglevel", "error", "-n",
plugins/muzhi-video-studio/scripts/production_runner.py, line 255
completed = subprocess.run(
Show more
plugins/muzhi-video-studio/scripts/project_state.py, line 769
shutil.rmtree(staging)
plugins/muzhi-video-studio/scripts/provider_router.py, line 524
completed = subprocess.run(
plugins/muzhi-video-studio/scripts/resource_handoff.py, line 945
run = subprocess.run([ffprobe, "-v", "error", "-show_entries
plugins/muzhi-video-studio/scripts/resource_handoff.py, line 1409
code = subprocess.run([node, str(tracer), "--project", str(root), "--runtime", str(runtime),
plugins/muzhi-video-studio/scripts/resource_handoff.py, line 2205
run = subprocess.run(prepared["command"], cwd=prepared["cwd"], capture_output=True, text=True, timeout=900)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
plugins/muzhi-video-studio/scripts/project_state.py, line 624
if lowered == "secrets" or lowered.startswith(".env"):
plugins/muzhi-video-studio/scripts/test_project_state.py, line 245
self.write(".env", b"NO")
plugins/muzhi-video-studio/scripts/test_project_state.py, line 254
state.package_files(self.root, json.dumps([".env"]), Path(self.temporary.name) / "other")
Show more
.gitignore, line 9
# Credentials and machine-local configuration
.gitignore, line 10
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
plugins/muzhi-video-studio/assets/shotcraft/full-index.json, line 1
{
plugins/muzhi-video-studio/assets/shotcraft/pinned-code-study.json, line 1
{
plugins/muzhi-video-studio/scripts/resource_handoff.py, line 2148
return "<!doctype html><html lang='zh-CN'><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>"+title+"</title><style>body{font:18px/1.6
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 6d8aff7060a8. requests shell access. No manifest field names shell or command execution. can delete files. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 6d8aff7060a842d8e6de114b4cfa484a5c574969
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.