registry / free-short-video / 7.2.0
free-short-video@7.2.0
Free AI short-video generator — run the full free-short-video service locally with one command. Text-to-video, image generation, Edge-TTS narration, subtitles, and compositing, all free. Official site: https://video.lichuanyang.top
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection found no lifecycle hook or concrete attack behavior. The flagged shell and environment access are part of the explicitly launched service setup, and the inspected frontend request is same-origin.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the package command or its start script.
Impact
The inspected behavior sets up and runs the advertised local video service; no concrete harmful effect was established.
Mechanism
The launcher prepares a package-local Python environment, starts the local server, and can open its local UI; the inspected frontend excerpt calls a same-origin configuration endpoint.
AI rationale
Source inspection found no lifecycle hook or concrete attack behavior. The flagged shell and environment access are part of the explicitly launched service setup, and the inspected frontend request is same-origin.
Evidence
package.jsonbin/cli.jsstatic/assets/index-dLHo75wx.js
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes bin/cli.js and defines only a start script, with no lifecycle hook.
- The CLI parses user-supplied options and installs Python dependencies into a package-local virtual environment when launched.
- The frontend requests configuration from the local /api/config endpoint.
Evidence against
- The CLI uses child_process for Python setup and service launch, and may open the local web UI; these actions support its stated launcher function.
- The CLI forwards AGNES_API_KEY to its service process, while the inspected frontend excerpt shows a same-origin local configuration API; no unrelated credential recipient or concealed transfer is established.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedbin/cli.jsView file
16L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
High
179}
L180: if (process.env.AGNES_API_KEY) {
L181: env.AGNES_API_KEY = process.env.AGNES_API_KEY;
...
L185: console.log('');
L186: console.log(` Web UI will be at http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${port}`);
L187: console.log(' Press Ctrl+C to stop.');
...
L189:
L190: const child = spawn(venvPython, ['server.py'], {
L191: cwd: PKG_ROOT,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L17916L17: const { spawn, execSync } = require('child_process');
L18: const fs = require('fs');
...
L21:
L22: const PKG_ROOT = path.resolve(__dirname, '..');
L23:
...
L25: const link = (url, text) =>
L26: process.stdout.isTTY ? `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\` : text;
L27:
...
L37: FSV_LOGO.forEach((l) => console.log(l));
L38: process.stdout.write('\x1b[0m');
L39: } else {
High
Sandbox Evasion Gated Capability
Findings
4 High4 Medium4 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperserver.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to free-short-video@7.2.0.
See all versions of free-short-video for other recorded verdicts.
- Review the evidence and your use of free-short-video@7.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.