Vidu API comic strip short film generation capability, with built-in AI-generated videos, images, and TTS.

The skill's name/description claim it uses Vidu API and ffmpeg — the code indeed calls Vidu endpoints and requires ffmpeg — but the registry metadata does not declare any required environment variables or primary credential. The scripts expect VIDU_API_KEY or a specific env var COZE_VIDU_API_7610322785025425408. That missing declaration is an incoherence (the skill will fail or silently look for other env names).

SKILL.md instructs installing ffmpeg and to configure Vidu API credentials; the included scripts access environment variables, call external HTTP endpoints (api.vidu.cn and arbitrary user-supplied URLs for assets/BGM), download resources, and write temporary files. The instructions and scripts are broadly scoped to generate/fetch media (expected) but they reference environment variables and a platform-specific import (coze_workload_identity) that are not declared in registry metadata — granting the agent access to system-level install commands and arbitrary network downloads without those requirements documented.

This is instruction-only (no install spec) so nothing is automatically downloaded at install time, which is lower risk. However SKILL.md suggests running apt-get install ffmpeg (system-level), and the scripts import requests and (in one file) coze_workload_identity.requests — runtime dependencies are not documented. There's no packaged install step, so operator must ensure ffmpeg/requests/coze_workload_identity are present.

The code expects API credentials via VIDU_API_KEY or a vendor/platform-specific env name COZE_VIDU_API_7610322785025425408. Registry metadata lists no required env vars or primary credential. Requiring an API token for Vidu is proportional for this skill, but the missing declaration plus a hard-coded skill id/env-var name is an incoherence and a risk (you may need to provide a differently named secret). Also the coze_workload_identity usage implies platform-specific credential behavior that should be explained.

Flags show always:false and default autonomous invocation settings. The skill does not request permanent platform privileges, does not modify other skills' configs, nor claim to persist credentials itself. This is normal.