registry / free-short-video / 7.1.1

free-short-video@7.1.1

Free AI short-video generator — run the full free-short-video service locally with one command. Text-to-video, image generation, Edge-TTS narration, subtitles, and compositing, all free. Official site: https://video.lichuanyang.top

AI Security Review

scanned 20d ago · by lpm-firewall-ai

The flagged process execution supports the CLI's documented local setup and server launch. The inspected frontend sends API keys to a relative application route and filters sensitive fields from analytics events; no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the CLI and opens the local web interface.

Impact

The inspected behavior supports the package's video-generation function, with no confirmed malicious effect.

Mechanism

The launcher prepares a local Python environment and starts the service; the frontend uses its relative API routes and loads Google Analytics.

AI rationale

Network endpoints1

www.googletagmanager.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes an explicit CLI and a start command, with no install lifecycle hook listed.
When the CLI is run, it creates a local Python environment and installs the listed dependencies.
The CLI launches the package's Python server as a child process with inherited environment settings.
The frontend sends a user-entered API key to its relative /api/config route.
The frontend loads Google Analytics and filters prompt and API-key fields from tracked event properties.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 1.56 MB of source, external domains: api.deepseek.com, developer.amd.com.cn, github.com, platform.agnes-ai.com, video.lichuanyang.top, vuejs.org, www.googletagmanager.com, www.python.org, www.w3.org

Source & flagged code

4 flagged

bin/cli.jsView file

16L17: const { spawn, execSync } = require('child_process'); L18: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L16

179} L180: if (process.env.AGNES_API_KEY) { L181: env.AGNES_API_KEY = process.env.AGNES_API_KEY; ... L185: console.log(''); L186: console.log(` Web UI will be at http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${port}`); L187: console.log(' Press Ctrl+C to stop.'); ... L189: L190: const child = spawn(venvPython, ['server.py'], { L191: cwd: PKG_ROOT,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L179

16L17: const { spawn, execSync } = require('child_process'); L18: const fs = require('fs'); ... L21: L22: const PKG_ROOT = path.resolve(__dirname, '..'); L23: ... L25: const link = (url, text) => L26: process.stdout.isTTY ? `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\` : text; L27: ... L37: FSV_LOGO.forEach((l) => console.log(l)); L38: process.stdout.write('\x1b[0m'); L39: } else {

High

Sandbox Evasion Gated Capability

Findings

4 High4 Medium4 Low

HighChild Processbin/cli.js

HighShell

HighSame File Env Network Executionbin/cli.js

HighSandbox Evasion Gated Capabilitybin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperserver.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to free-short-video@7.1.1.

See all versions of free-short-video for other recorded verdicts.

Review the evidence and your use of free-short-video@7.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 18:51:01.049Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / free-short-video / 7.1.1

free-short-video@7.1.1

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the CLI and opens the local web interface.

Impact

The inspected behavior supports the package's video-generation function, with no confirmed malicious effect.

Mechanism

The launcher prepares a local Python environment and starts the service; the frontend uses its relative API routes and loads Google Analytics.

AI rationale

Network endpoints1

www.googletagmanager.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes an explicit CLI and a start command, with no install lifecycle hook listed.
When the CLI is run, it creates a local Python environment and installs the listed dependencies.
The CLI launches the package's Python server as a child process with inherited environment settings.
The frontend sends a user-entered API key to its relative /api/config route.
The frontend loads Google Analytics and filters prompt and API-key fields from tracked event properties.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

bin/cli.jsView file

16L17: const { spawn, execSync } = require('child_process'); L18: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L16

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L179

High

Sandbox Evasion Gated Capability

Findings

4 High4 Medium4 Low

HighChild Processbin/cli.js

HighShell

HighSame File Env Network Executionbin/cli.js

HighSandbox Evasion Gated Capabilitybin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperserver.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to free-short-video@7.1.1.

See all versions of free-short-video for other recorded verdicts.

Review the evidence and your use of free-short-video@7.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 18:51:01.049Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.