registry / free-short-video / 6.4.6
free-short-video@6.4.6
⚠ Under reviewFree AI short-video generator — run the full free-short-video service locally with one command. Text-to-video, image generation, Edge-TTS narration, subtitles, and compositing, all free. Official site: https://video.lichuanyang.top
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedbin/cli.jsView file
16L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
High
179}
L180: if (process.env.AGNES_API_KEY) {
L181: env.AGNES_API_KEY = process.env.AGNES_API_KEY;
...
L185: console.log('');
L186: console.log(` Web UI will be at http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${port}`);
L187: console.log(' Press Ctrl+C to stop.');
...
L189:
L190: const child = spawn(venvPython, ['server.py'], {
L191: cwd: PKG_ROOT,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L17916L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
...
L21:
L22: const PKG_ROOT = path.resolve(__dirname, '..');
L23:
...
L25: const link = (url, text) =>
L26: process.stdout.isTTY ? `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\` : text;
L27:
...
L37: FSV_LOGO.forEach((l) => console.log(l));
L38: process.stdout.write('\x1b[0m');
L39: } else {
High
Sandbox Evasion Gated Capability
Findings
3 High4 Medium4 Low
HighChild Processbin/cli.js
HighSame File Env Network Executionbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperserver.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to free-short-video@6.4.6.
See all versions of free-short-video for other recorded verdicts.
- Review the evidence and your use of free-short-video@6.4.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.