registry / free-short-video / 6.4.8
free-short-video@6.4.8
Free AI short-video generator — run the full free-short-video service locally with one command. Text-to-video, image generation, Edge-TTS narration, subtitles, and compositing, all free. Official site: https://video.lichuanyang.top
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no install lifecycle hook or concrete malicious behavior. Network configuration is restricted to named Agnes API hosts used by the application.
Static reason
One or more suspicious static signals were detected.
Trigger
The user explicitly runs the command-line launcher.
Impact
No confirmed malicious mutation, credential exfiltration, or remote payload execution was found.
Mechanism
The launcher creates a package-local Python environment, installs its requirements, and starts the local server.
AI rationale
Static inspection found no install lifecycle hook or concrete malicious behavior. Network configuration is restricted to named Agnes API hosts used by the application.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a command-line launcher and has no npm lifecycle hook.
- The launcher installs declared Python requirements only after the user runs the command, then starts the local service.
- Configured API destinations are limited to listed Agnes API hosts.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedbin/cli.jsView file
16L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
High
179}
L180: if (process.env.AGNES_API_KEY) {
L181: env.AGNES_API_KEY = process.env.AGNES_API_KEY;
...
L185: console.log('');
L186: console.log(` Web UI will be at http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${port}`);
L187: console.log(' Press Ctrl+C to stop.');
...
L189:
L190: const child = spawn(venvPython, ['server.py'], {
L191: cwd: PKG_ROOT,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L17916L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
...
L21:
L22: const PKG_ROOT = path.resolve(__dirname, '..');
L23:
...
L25: const link = (url, text) =>
L26: process.stdout.isTTY ? `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\` : text;
L27:
...
L37: FSV_LOGO.forEach((l) => console.log(l));
L38: process.stdout.write('\x1b[0m');
L39: } else {
High
Sandbox Evasion Gated Capability
Findings
3 High4 Medium5 Low
HighChild Processbin/cli.js
HighSame File Env Network Executionbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperserver.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to free-short-video@6.4.8.
See all versions of free-short-video for other recorded verdicts.
- Review the evidence and your use of free-short-video@6.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.