Skills video-enhancement
π¦
video-enhancement
v1.2.0 Content revision r1 High Risk π Network accessπ Env variablesβοΈ External commandsπ Filesystem access
Enhance Short Videos with AI Upscaling
Short videos can lose detail after compression, trimming, or remote downloads. This skill uses Verging AI workflows to upscale, denoise, and return enhanced clips.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "video-enhancement" from https://skillstore.io/skills/verging-ai-video-enhancement.md and its manifest at https://skillstore.io/api/skills/verging-ai-video-enhancement/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "video-enhancement". Local 18 second MP4 in normal mode.
Expected outcome:
- The skill reports the estimated credit cost.
- It uploads the trimmed clip and starts the enhancement job.
- It returns a completion status and final video link.
Using "video-enhancement". Remote YouTube clip with HD mode and a 20 second trim.
Expected outcome:
The skill downloads the requested segment, enhances it in HD, and saves the finished video when download is enabled.
Using "video-enhancement". Rights-cleared archive clip with noise and low resolution.
Expected outcome:
The skill produces a sharper enhanced clip and reports where the processed result can be accessed.
Security Audit
High Riskv7 β’ 7/7/2026 Open versioned report
The skill intentionally uses external network calls, local media commands, temporary files, and a Verging API key. Many Markdown backtick detections are formatting false positives, but the documented execution flow confirms real curl, yt-dlp, ffprobe, and ffmpeg use. No prompt injection attempt was found in the reviewed files.
2
Files scanned
215
Lines analyzed
30
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Third-Party Video Upload
The workflow uploads user video content to Verging and a presigned storage URL for enhancement. Private or regulated media could leave the user device without enough consent controls.
The documented flow explicitly requests an upload URL, uploads a local video file, and creates an enhancement job with the uploaded video URL.
Medium
User-Supplied URL Download and Media Processing
The skill accepts user-provided video paths or URLs and runs yt-dlp, ffprobe, and ffmpeg on that input. Without strict validation, this can trigger unwanted network access or risky media parsing.
The option table accepts a file path or URL, and the execution flow directly maps those inputs into yt-dlp, ffprobe, and ffmpeg processing steps.
Capability review items (30)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
export VERGING_API_KEY="vrg_sk_your_key_here"
The setup instructs users to place a real Verging API key in the environment. The value is intended, but the skill later uses it in authorization headers.
High
Generic API/secret keys
- VERGING_API_KEY
The metadata explicitly requires VERGING_API_KEY. Granting this secret to the skill is a real credential access risk.
High
Generic API/secret keys
primaryEnv: VERGING_API_KEY
The metadata marks VERGING_API_KEY as the primary environment secret. This confirms the skill is designed to access a credential.
High
Generic API/secret keys
| --api-key | -k | API Key | $VERGING_API_KEY |
The option table defaults the API key to VERGING_API_KEY. This is intended, but it confirms secret-dependent execution.
High
Generic API/secret keys
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The curl command sends VERGING_API_KEY in an Authorization header to the external API. This is direct credential use over the network.
High
Generic API/secret keys
-H "Authorization: ApiKey $VERGING_API_KEY" \
The upload URL request sends VERGING_API_KEY in an Authorization header. This is direct use of a secret for external API access.
High
Generic API/secret keys
-H "Authorization: ApiKey $VERGING_API_KEY" \
The job creation request sends VERGING_API_KEY to the external API. This is direct credential use in a command invocation.
High
Generic API/secret keys
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The polling command sends VERGING_API_KEY in an Authorization header. This is expected but still exposes a credential to command execution.
High
Generic API/secret keys
- Set key via env: `export VERGING_API_KEY="your_key"`
The line advises setting a key by environment variable and warns against exposure. It is security guidance, but still confirms secret handling by the skill.
Medium
Ruby/shell backtick execution
```bash
The block contains curl commands to the Verging API. These commands are part of the documented workflow and perform external network operations with credentials.
Medium
Ruby/shell backtick execution
```bash
The line range contains a curl command that sends the API key to check account credits. This is intended behavior but is real external command execution.
Medium
Ruby/shell backtick execution
```bash
The line range contains a curl POST that requests an upload URL using the API key. It is a real command path for external service interaction.
Medium
Ruby/shell backtick execution
```bash
The block contains curl uploading a local video file to a presigned URL. This is real command execution that moves user media off the machine.
Medium
Ruby/shell backtick execution
```bash
The block contains a curl POST that creates the enhancement job. It sends metadata and a target video URL to the external service.
Medium
Ruby/shell backtick execution
```bash
The line range contains a curl polling command for job status. It is expected, but still requires external command and network execution.
Medium
Ruby/shell backtick execution
2. **Download remote video** (if URL): `yt-dlp "URL" -o /tmp/verging-video-enhancement/input.mp4`
The execution flow instructs running yt-dlp against a user-supplied URL and ffprobe on media. This is real external command execution on untrusted inputs.
Medium
Ruby/shell backtick execution
3. **Get duration** β `ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1
The range includes ffprobe usage to inspect user-provided media. This is legitimate processing, but it executes a local binary on untrusted files.
Medium
Ruby/shell backtick execution
```bash
The block contains an ffmpeg command to trim user media. It is intended behavior, but it runs a complex media parser on user-controlled input.
Medium
Ruby/shell backtick execution
```
The range describes the remaining workflow, including API calls and optional curl download. It is less direct than the command blocks, but still confirms command-driven behavior.
Medium
Hardcoded URL
"public_url": "https://img.panpan8.com/video-enhance/..."
The response example shows a public media URL on an external storage host. It indicates uploaded video may be exposed through a hosted URL.
Medium
Temp directory access
curl -X PUT -T /tmp/verging-video-enhancement/trimmed.mp4 \
The upload command reads a video from a fixed /tmp path. Fixed temporary locations can leak or collide if permissions and cleanup are weak.
Medium
Temp directory access
2. **Download remote video** (if URL): `yt-dlp "URL" -o /tmp/verging-video-enhancement/input.mp4`
The workflow downloads remote media into a fixed /tmp path. This creates filesystem risk from untrusted media and predictable file locations.
Medium
Temp directory access
ffmpeg -i input.mp4 -ss <start> -to <end> -c:v libx264 -c:a aac /tmp/verging-video-enhancement/trimm
The ffmpeg command writes trimmed output to a fixed /tmp path. Predictable temporary media files can remain accessible if cleanup fails.
Medium
Temp directory access
- **Temp directory:** `/tmp/verging-video-enhancement/`
The documented temp directory is fixed and shared under /tmp. The note is intentional, but the design needs strict permissions and cleanup.
Low
Hardcoded URL
curl -H "Authorization: ApiKey vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The curl example targets the Verging authentication API. It is an intended endpoint, but it confirms outbound calls with authorization headers.
Low
Hardcoded URL
curl -H "Authorization: Bearer vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The curl example targets the same Verging authentication API with a bearer-style header. It confirms intentional outbound API access.
Low
Hardcoded URL
https://verging.ai/api/v1/auth/me
The workflow calls the Verging auth endpoint to check credits. This is real network access using the configured API key.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/upload-video \
The workflow posts to the Verging upload endpoint before media upload. This is real external network behavior.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/video_enhance/create-job \
The workflow posts to the Verging video enhancement endpoint. This is core external processing behavior.
Low
Hardcoded URL
"https://verging.ai/api/v1/jobs/list-jobs?job_ids=<job_id>"
The workflow polls a Verging jobs endpoint for status. It is intended, but confirms recurring outbound API access.
Risk Factors
π Network access (11)
π Env variables (9)
βοΈ External commands (29)
SKILL.md:27-29 SKILL.md:29-45 SKILL.md:45-47 SKILL.md:47-53 SKILL.md:53-60 SKILL.md:60-63 SKILL.md:63-64 SKILL.md:64-67 SKILL.md:67-73 SKILL.md:73-75 SKILL.md:75-83 SKILL.md:83-86 SKILL.md:86-90 SKILL.md:90-93 SKILL.md:93-102 SKILL.md:102-103 SKILL.md:103-106 SKILL.md:106-109 SKILL.md:109-110 SKILL.md:110-112 SKILL.md:112 SKILL.md:117-118 SKILL.md:118-120 SKILL.md:120-122 SKILL.md:122-131 SKILL.md:131 SKILL.md:132 SKILL.md:133 SKILL.md:135-147
π Filesystem access (4)
Audited by: codex View Audit History β
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/verging-ai-video-enhancement/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/verging-ai-video-enhancement?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/verging-ai-video-enhancement?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/verging-ai-video-enhancement/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/verging-ai-video-enhancement.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA Β· BibTeX Β· CFF)
APA citation
verging.ai. (2026). video-enhancement security audit report (audit version 7) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/verging-ai-video-enhancement/audits/7BibTeX citation
@techreport{verging-ai-verging-ai-video-enhancement-2026,
author = {verging.ai},
title = {video-enhancement security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/verging-ai-video-enhancement/audits/7},
note = {Author version 1.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "video-enhancement security audit report (audit version 7)"
version: "1.2.0"
type: report
authors:
- name: "verging.ai"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/verging-ai-video-enhancement/audits/7"
identifiers:
- type: other
value: "skillstore:verging-ai-video-enhancement:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
71
Community
91
Spec Compliance
What You Can Build
Improve Creator Clips
Upscale a short social clip, reduce noise, and download a cleaner version for publishing.
Prepare Marketing Shorts
Trim a campaign video to the required segment and create an HD version for review.
Restore Review Footage
Enhance a rights-cleared archived clip before editing, sharing, or quality inspection.
Try These Prompts
Enhance a Local Clip
Enhance my local video at ./clip.mp4 with default quality. Show the credit estimate before starting the job.
Trim a Remote Clip
Enhance this YouTube clip from 5 to 25 seconds. Use normal quality and return the final result link.
Create an HD Review File
Use my Verging API key from the environment. Enhance ./promo.mp4 in HD from 3 to 28 seconds and save the result in ./exports.
Run a Controlled Enhancement
Before uploading, confirm the clip duration, credit cost, output path, and that the media is approved for external processing.
Best Practices
- Use only videos you own or have permission to process externally.
- Keep the Verging API key in an environment variable and rotate it after exposure.
- Set start and end times to control cost and stay within the 30 second limit.
Avoid
- Do not paste real API keys into prompts, command examples, screenshots, or logs.
- Do not upload private, regulated, or client media without explicit approval.
- Do not pass unknown remote URLs without checking source trust and rights.
Frequently Asked Questions
Does the enhancement run only on my computer?
No. Local tools prepare the clip, then the video is uploaded to Verging for enhancement.
What credentials are required?
The skill requires a Verging API key, usually provided through the VERGING_API_KEY environment variable.
Can it process YouTube or Bilibili videos?
Yes, if yt-dlp is installed and you have the rights to download and process the video.
What is the maximum video length?
The documented maximum is 30 seconds. Longer videos should be trimmed before enhancement.
What tools must be installed locally?
The workflow expects yt-dlp, ffmpeg, ffprobe, and curl to be available.
Can it download the final result automatically?
Yes. The documented download option saves the completed enhanced video to the chosen output path.
Developer Details
Author
verging.aiLicense
MIT
Author version
v1.2.0
Skillstore revision
r1
Ref
36e07d5e13068e5be64447e8f20b427cf2cbd21a
Maintenance freshness
7/18/2026
Usage
12 downloads Β· 250 views