registry / free-short-video / 6.5.0
free-short-video@6.5.0
Free AI short-video generator — run the full free-short-video service locally with one command. Text-to-video, image generation, Edge-TTS narration, subtitles, and compositing, all free. Official site: https://video.lichuanyang.top
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found a user-invoked local-service launcher rather than an automatic or covert attack path. Its external API destinations are restricted in source.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the free-short-video command or start script.
Impact
No unconsented install-time execution, credential export to an unrestricted host, persistence, or destructive behavior was identified.
Mechanism
The launcher creates a local Python environment, installs declared requirements, and starts the bundled server. API traffic is directed to listed Agnes service hosts.
AI rationale
Static inspection found a user-invoked local-service launcher rather than an automatic or covert attack path. Its external API destinations are restricted in source.
Evidence
bin/cli.js
Network endpoints2
apihub.agnes-ai.comapi.agnes-ai.cn
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a command-line launcher and a start script, with no install lifecycle hook.
- The launcher creates a local virtual environment and installs its declared Python requirements only when the user runs the command.
- The launcher starts the package-local Python service.
- API destinations are limited to listed Agnes service hosts.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedbin/cli.jsView file
16L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
High
179}
L180: if (process.env.AGNES_API_KEY) {
L181: env.AGNES_API_KEY = process.env.AGNES_API_KEY;
...
L185: console.log('');
L186: console.log(` Web UI will be at http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${port}`);
L187: console.log(' Press Ctrl+C to stop.');
...
L189:
L190: const child = spawn(venvPython, ['server.py'], {
L191: cwd: PKG_ROOT,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L17916L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
...
L21:
L22: const PKG_ROOT = path.resolve(__dirname, '..');
L23:
...
L25: const link = (url, text) =>
L26: process.stdout.isTTY ? `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\` : text;
L27:
...
L37: FSV_LOGO.forEach((l) => console.log(l));
L38: process.stdout.write('\x1b[0m');
L39: } else {
High
Sandbox Evasion Gated Capability
Findings
3 High4 Medium5 Low
HighChild Processbin/cli.js
HighSame File Env Network Executionbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperserver.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to free-short-video@6.5.0.
See all versions of free-short-video for other recorded verdicts.
- Review the evidence and your use of free-short-video@6.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.