技能 video-enhancement
📦
video-enhancement
v1.2.0 内容修订 r1 高风险 🌐 网络访问🔑 环境变量⚙️ 外部命令📁 文件系统访问
使用 AI 增强短视频
短视频片段在发布前通常需要锐化、降噪或提升分辨率。此技能会引导 Claude、Codex 或 Claude Code 完成 verging.ai 上传、任务创建、进度检查和结果下载。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "video-enhancement" from https://skillstore.io/skills/verging-ai-video-enhancement.md and its manifest at https://skillstore.io/api/skills/verging-ai-video-enhancement/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“video-enhancement”。 增强 ./launch-demo.mp4 并返回结果链接。
预期结果:
助手会检查片段时长，必要时进行裁剪，将其上传到 verging.ai，创建增强任务，轮询进度，并返回完成后的视频链接。
正在使用“video-enhancement”。 以 HD 增强这个 YouTube 视频的前 20 秒并下载。
预期结果:
助手会下载源视频，创建 20 秒片段，估算 HD credit 用量，提交增强任务，并将完成后的文件保存到本地。
安全审计
高风险v7 • 2026/7/7 打开版本化报告
The skill intentionally uses external network calls, local media commands, temporary files, and a Verging API key. Many Markdown backtick detections are formatting false positives, but the documented execution flow confirms real curl, yt-dlp, ffprobe, and ffmpeg use. No prompt injection attempt was found in the reviewed files.
2
已扫描文件
215
分析行数
30
复核项
0
已忽略误报
已确认安全问题 (2)
高
Third-Party Video Upload
The workflow uploads user video content to Verging and a presigned storage URL for enhancement. Private or regulated media could leave the user device without enough consent controls.
The documented flow explicitly requests an upload URL, uploads a local video file, and creates an enhancement job with the uploaded video URL.
中
User-Supplied URL Download and Media Processing
The skill accepts user-provided video paths or URLs and runs yt-dlp, ffprobe, and ffmpeg on that input. Without strict validation, this can trigger unwanted network access or risky media parsing.
The option table accepts a file path or URL, and the execution flow directly maps those inputs into yt-dlp, ffprobe, and ffmpeg processing steps.
能力复核项 (30)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Generic API/secret keys
export VERGING_API_KEY="vrg_sk_your_key_here"
The setup instructs users to place a real Verging API key in the environment. The value is intended, but the skill later uses it in authorization headers.
高
Generic API/secret keys
- VERGING_API_KEY
The metadata explicitly requires VERGING_API_KEY. Granting this secret to the skill is a real credential access risk.
高
Generic API/secret keys
primaryEnv: VERGING_API_KEY
The metadata marks VERGING_API_KEY as the primary environment secret. This confirms the skill is designed to access a credential.
高
Generic API/secret keys
| --api-key | -k | API Key | $VERGING_API_KEY |
The option table defaults the API key to VERGING_API_KEY. This is intended, but it confirms secret-dependent execution.
高
Generic API/secret keys
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The curl command sends VERGING_API_KEY in an Authorization header to the external API. This is direct credential use over the network.
高
Generic API/secret keys
-H "Authorization: ApiKey $VERGING_API_KEY" \
The upload URL request sends VERGING_API_KEY in an Authorization header. This is direct use of a secret for external API access.
高
Generic API/secret keys
-H "Authorization: ApiKey $VERGING_API_KEY" \
The job creation request sends VERGING_API_KEY to the external API. This is direct credential use in a command invocation.
高
Generic API/secret keys
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The polling command sends VERGING_API_KEY in an Authorization header. This is expected but still exposes a credential to command execution.
高
Generic API/secret keys
- Set key via env: `export VERGING_API_KEY="your_key"`
The line advises setting a key by environment variable and warns against exposure. It is security guidance, but still confirms secret handling by the skill.
中
Ruby/shell backtick execution
```bash
The block contains curl commands to the Verging API. These commands are part of the documented workflow and perform external network operations with credentials.
中
Ruby/shell backtick execution
```bash
The line range contains a curl command that sends the API key to check account credits. This is intended behavior but is real external command execution.
中
Ruby/shell backtick execution
```bash
The line range contains a curl POST that requests an upload URL using the API key. It is a real command path for external service interaction.
中
Ruby/shell backtick execution
```bash
The block contains curl uploading a local video file to a presigned URL. This is real command execution that moves user media off the machine.
中
Ruby/shell backtick execution
```bash
The block contains a curl POST that creates the enhancement job. It sends metadata and a target video URL to the external service.
中
Ruby/shell backtick execution
```bash
The line range contains a curl polling command for job status. It is expected, but still requires external command and network execution.
中
Ruby/shell backtick execution
2. **Download remote video** (if URL): `yt-dlp "URL" -o /tmp/verging-video-enhancement/input.mp4`
The execution flow instructs running yt-dlp against a user-supplied URL and ffprobe on media. This is real external command execution on untrusted inputs.
中
Ruby/shell backtick execution
3. **Get duration** → `ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1
The range includes ffprobe usage to inspect user-provided media. This is legitimate processing, but it executes a local binary on untrusted files.
中
Ruby/shell backtick execution
```bash
The block contains an ffmpeg command to trim user media. It is intended behavior, but it runs a complex media parser on user-controlled input.
中
Ruby/shell backtick execution
```
The range describes the remaining workflow, including API calls and optional curl download. It is less direct than the command blocks, but still confirms command-driven behavior.
中
Hardcoded URL
"public_url": "https://img.panpan8.com/video-enhance/..."
The response example shows a public media URL on an external storage host. It indicates uploaded video may be exposed through a hosted URL.
中
Temp directory access
curl -X PUT -T /tmp/verging-video-enhancement/trimmed.mp4 \
The upload command reads a video from a fixed /tmp path. Fixed temporary locations can leak or collide if permissions and cleanup are weak.
中
Temp directory access
2. **Download remote video** (if URL): `yt-dlp "URL" -o /tmp/verging-video-enhancement/input.mp4`
The workflow downloads remote media into a fixed /tmp path. This creates filesystem risk from untrusted media and predictable file locations.
中
Temp directory access
ffmpeg -i input.mp4 -ss <start> -to <end> -c:v libx264 -c:a aac /tmp/verging-video-enhancement/trimm
The ffmpeg command writes trimmed output to a fixed /tmp path. Predictable temporary media files can remain accessible if cleanup fails.
中
Temp directory access
- **Temp directory:** `/tmp/verging-video-enhancement/`
The documented temp directory is fixed and shared under /tmp. The note is intentional, but the design needs strict permissions and cleanup.
低
Hardcoded URL
curl -H "Authorization: ApiKey vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The curl example targets the Verging authentication API. It is an intended endpoint, but it confirms outbound calls with authorization headers.
低
Hardcoded URL
curl -H "Authorization: Bearer vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The curl example targets the same Verging authentication API with a bearer-style header. It confirms intentional outbound API access.
低
Hardcoded URL
https://verging.ai/api/v1/auth/me
The workflow calls the Verging auth endpoint to check credits. This is real network access using the configured API key.
低
Hardcoded URL
curl -X POST https://verging.ai/api/v1/upload-video \
The workflow posts to the Verging upload endpoint before media upload. This is real external network behavior.
低
Hardcoded URL
curl -X POST https://verging.ai/api/v1/video_enhance/create-job \
The workflow posts to the Verging video enhancement endpoint. This is core external processing behavior.
低
Hardcoded URL
"https://verging.ai/api/v1/jobs/list-jobs?job_ids=<job_id>"
The workflow polls a Verging jobs endpoint for status. It is intended, but confirms recurring outbound API access.
风险因素
🌐 网络访问 (11)
🔑 环境变量 (9)
⚙️ 外部命令 (29)
SKILL.md:27-29 SKILL.md:29-45 SKILL.md:45-47 SKILL.md:47-53 SKILL.md:53-60 SKILL.md:60-63 SKILL.md:63-64 SKILL.md:64-67 SKILL.md:67-73 SKILL.md:73-75 SKILL.md:75-83 SKILL.md:83-86 SKILL.md:86-90 SKILL.md:90-93 SKILL.md:93-102 SKILL.md:102-103 SKILL.md:103-106 SKILL.md:106-109 SKILL.md:109-110 SKILL.md:110-112 SKILL.md:112 SKILL.md:117-118 SKILL.md:118-120 SKILL.md:120-122 SKILL.md:122-131 SKILL.md:131 SKILL.md:132 SKILL.md:133 SKILL.md:135-147
📁 文件系统访问 (4)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/verging-ai-video-enhancement/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/verging-ai-video-enhancement?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/verging-ai-video-enhancement?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/verging-ai-video-enhancement/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/verging-ai-video-enhancement.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
verging.ai. (2026). video-enhancement security audit report (audit version 7) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/verging-ai-video-enhancement/audits/7BibTeX 引用
@techreport{verging-ai-verging-ai-video-enhancement-2026,
author = {verging.ai},
title = {video-enhancement security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/verging-ai-video-enhancement/audits/7},
note = {Author version 1.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "video-enhancement security audit report (audit version 7)"
version: "1.2.0"
type: report
authors:
- name: "verging.ai"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/verging-ai-video-enhancement/audits/7"
identifiers:
- type: other
value: "skillstore:verging-ai-video-enhancement:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
100
可维护性
87
内容
71
社区
91
规范符合性
你能构建什么
准备社交媒体片段
在发布前通过裁剪、增强细节并下载结果来改善短片段。
清理产品演示素材
当源视频噪点较多或分辨率较低时，增强短软件或产品演示视频。
通过 API 处理测试媒体
针对 verging.ai 视频增强服务运行可重复的上传、任务创建和轮询工作流。
试试这些提示
增强本地片段
对 ./clip.mp4 使用 video-enhancement 技能。保持普通质量模式并返回结果链接。
增强并下载
使用 video-enhancement 增强 ./demo.mp4，将其裁剪为前 20 秒，并将完成后的结果下载到当前目录。
提升远程视频片段分辨率
对这个 YouTube URL 使用 video-enhancement，处理第 5 秒到第 25 秒，启用 HD 模式，并在上传前显示 credit 估算。
处理敏感媒体前审计
在对 ./private-review.mp4 运行 video-enhancement 之前，请总结将读取哪些文件、视频将上传到哪里、预期 credit 成本，并请求批准。
最佳实践
- 确认用户拥有每个视频或有权处理每个视频。
- 在开始前说明该片段将上传到 verging.ai。
- 使用环境变量存放 API keys，并避免打印 secret values。
避免
- 不要在没有用户明确批准的情况下处理私密或受监管媒体。
- 不要将 API keys 直接粘贴到 prompts、logs 或共享文件中。
- 不要在未经许可的情况下下载或增强受版权保护的远程视频。
常见问题
此技能增强什么内容？
它通过使用 verging.ai API 对短视频片段进行超分辨率、降噪和锐化增强。
它能处理本地文件吗？
可以。文档化命令接受本地视频路径作为必需的视频输入。
它能处理 YouTube 或 Bilibili 链接吗？
可以，前提是 yt-dlp 可用，并且用户有权下载和处理该媒体。
它需要 API key 吗？
需要。它需要 VERGING_API_KEY 才能向 verging.ai API 发起经过身份验证的请求。
我的视频会离开我的机器吗？
会。该工作流会将片段上传到 verging.ai 或预签名存储 URL 以进行远程处理。
主要的安全注意事项是什么？
确认上传同意，保护 API key，使用可信的输入视频，并在处理后清理临时文件。
开发者详情
作者
verging.ai许可证
MIT
作者版本
v1.2.0
Skillstore 修订
r1
引用
36e07d5e13068e5be64447e8f20b427cf2cbd21a
维护新鲜度
2026/7/18
使用量
12 次下载 · 250 次浏览