Anil-matcha/AI-Youtube-Shorts-Generator

Review signals: 1 connection review, 34 known vulnerability.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 43 distinct locations. 14 attributed processes.

OSV reports a known vulnerability in this dependency version. 4 distinct locations. 26 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "<guest-path>",
        "main.py",
        "https://www.youtube.com/watch?v=8Ua5lRiePFg",
        "--num-clips",
        "1"
      ],
      "kind": "cli",
      "returncode": 1,
      "stdout": "[download] requesting https://www.youtube.com/watch?v=8Ua5lRiePFg @ 720p",
      "stderr": "\nFAILED: MUAPI_API_KEY is not set. Add it to your .env file or export it as an env var.",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: missing credentials"
    },
    "check": "credentials_error",
    "optional": false
  },
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "<guest-path>",
        "main.py",
        "<guest-path>",
        "--mode",
        "local",
        "--num-clips",
        "1"
      ],
      "kind": "cli",
      "returncode": 1,
      "stdout": "[download/local] using local file: <guest-path>\n[transcribe/local] reusing cached transcript: <guest-path>\n[transcribe/local] 1 cached segments, 7s of audio\n[highlights] content=other density=medium duration=7s",
      "stderr": "\nFAILED: OPENAI_API_KEY is not set. Local mode needs an OpenAI key for highlight ranking. Add it to your .env or export it, or switch back to --mode api.",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: missing credentials"
    },
    "check": "credentials_error",
    "optional": false
  }
]

• Local mode accepts a direct filesystem path and skips YouTube: Needs OPENAI_API_KEY or GEMINI_API_KEY for the highlight-ranking step, which this guest does not have. The path was accepted and local transcription ran on <guest-path> (1 segment, 8s), then the run stopped with 'OPENAI_API_KEY is not set'.

  Source: In `--mode local`, you can pass a `file://` URL or a direct filesystem path and skip YouTube entirely

  Observed: Needs OPENAI_API_KEY or GEMINI_API_KEY for the highlight-ranking step, which this guest does not have. The path was accepted and local transcription ran on <guest-path> (1 segment, 8s), then the run stopped with 'OPENAI_API_KEY is not set'.

• API mode needs a MuAPI key: Needs MUAPI_API_KEY, which this guest does not have. Ran the documented API-mode command without a key; it stopped with 'MUAPI_API_KEY is not set' (exit 1). Recorded as the credentials_error check in probe.json.

  Source: For **API mode (default)**: a MuAPI key

  Observed: Needs MUAPI_API_KEY, which this guest does not have. Ran the documented API-mode command without a key; it stopped with 'MUAPI_API_KEY is not set' (exit 1). Recorded as the credentials_error check in probe.json.

• Local mode writes shorts and transcript cache to LOCAL_OUTPUT_DIR: Needs an OpenAI or Gemini key before shorts are rendered. The transcript cache step did run: <guest-path> was written (verified contents) before the missing-key stop.

  Source: Local transcription is cached as an `.srt` file in `LOCAL_OUTPUT_DIR` using the

  Observed: Needs an OpenAI or Gemini key before shorts are rendered. The transcript cache step did run: <guest-path> was written (verified contents) before the missing-key stop.

Examples

• Single video, API mode quickstart: Needs MUAPI_API_KEY, which is not available in this guest. Ran the documented command with no key; it stopped with 'MUAPI_API_KEY is not set' (exit 1). Covered by the credentials_error check in probe.json.

  Source: README.md Usage / Single video (API mode — default)

  Expected: documented command completes successfully

  Observed: Needs MUAPI_API_KEY, which is not available in this guest. Ran the documented command with no key; it stopped with 'MUAPI_API_KEY is not set' (exit 1). Covered by the credentials_error check in probe.json.

• Single video, local mode quickstart: Needs OPENAI_API_KEY or GEMINI_API_KEY for highlight ranking, which is not available. A YouTube URL was not used because only a local file was reachable without a key. Local file transcription ran to completion and wrote a cache .srt before stopping at the missing OPENAI_API_KEY.

  Source: README.md Usage / Single video (Local mode)

  Expected: documented command completes successfully

  Observed: Needs OPENAI_API_KEY or GEMINI_API_KEY for highlight ranking, which is not available. A YouTube URL was not used because only a local file was reachable without a key. Local file transcription ran to completion and wrote a cache .srt before stopping at the missing OPENAI_API_KEY.

• Batch processing with xargs: Each line runs main.py, which needs a MuAPI key (API mode) or an OpenAI/Gemini key (local mode). Not runnable without credentials; the single-run paths above stop at the same missing-key checks.

  Source: README.md Usage / Batch processing

  Expected: documented command completes successfully

  Observed: Each line runs main.py, which needs a MuAPI key (API mode) or an OpenAI/Gemini key (local mode). Not runnable without credentials; the single-run paths above stop at the same missing-key checks.

Local or hosted: both

Turn a YouTube URL (API mode) or a local video file (local mode) into ranked vertical shorts with python main.py

cd <guest-path> && ls -la && cat README.md 2>/dev/null | head -200; python3 --version; id -u; cat /etc/os-release | head -3; ls /inputs 2>/dev/null
cd <guest-path> && sed -n 200,400p README.md; echo ----; cat requirements.txt requirements-local.txt .env.example; echo ----; cat main.py; ls -la .coldpass .claude; ls shorts_generator; ls -a .git 2>&1 | head -1
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/Anil-matcha/AI-Youtube-Shorts-Generator 2>&1; timeout 120 git fetch --depth 1 origin 70c5fa96984cbc35b3b76a981a81c676117370ec 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git rev-parse HEAD; git status --short | head; echo ---; which ffmpeg ffprobe; ls <guest-path>; env | grep -i -E 'muapi|openai|gemini|proxy' | sed 's/=.*/=<set>/'; dpkg -l python3.12-venv 2>/dev/null | tail -1
cd <guest-path> && (sudo -n apt-get update -qq >/tmp/apt.log 2>&1; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3.12-venv ffmpeg >>/tmp/apt.log 2>&1; echo apt=$?) ; python3 -m venv <guest-path> && <guest-path> install -q -r requirements.txt 2>&1 | tail -5; echo pip=$?; <guest-path> -c "import requests, dotenv; print('ok')"; ffmpeg -version | head -1
cd <guest-path> && cat shorts_generator/config.py; echo ----; sed -n 1,60p shorts_generator/muapi.py; echo ----; cat shorts_generator/pipeline.py | head -80
cd <guest-path> && ls -a | grep -c '^.env$'; timeout 120 <guest-path> main.py "https://www.youtube.com/watch?v=8Ua5lRiePFg" --num-clips 1 --output-json .coldpass/api_result.json; echo "rc=$?"
cd <guest-path> && timeout 900 <guest-path> install -q -r requirements-local.txt > /tmp/pip-local.log 2>&1; echo pip_local=$?; tail -3 /tmp/pip-local.log; <guest-path> -c "import yt_dlp, faster_whisper, cv2, openai; print('local imports ok')"
mkdir -p <guest-path> && cd <guest-path> && (sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq espeak-ng >/tmp/apt2.log 2>&1; echo espeak_install=$?) && espeak-ng -w speech.wav "Welcome to the show. This is the most surprising thing I learned this year. Nobody tells you that, but it changed everything for me." && ffmpeg -y -loglevel error -f lavfi -i testsrc=size=640x360:rate=25:duration=20 -i speech.wav -shortest -c:v libx264 -pix_fmt yuv420p -c:a aac input.mp4 && ls -la input.mp4; timeout 20 curl -sI https://huggingface.co | head -1; echo hf_rc=$?
cd <guest-path> && mkdir -p <guest-path> && LOCAL_OUTPUT_DIR=<guest-path> timeout 1500 <guest-path> main.py <guest-path> --mode local --num-clips 1 2>&1 | tail -30; echo "rc=${PIPESTATUS[0]}"; ls -la <guest-path>
cd <guest-path> && cat shorts_generator/local/transcriber.py | head -40; echo ----; LOCAL_OUTPUT_DIR=<guest-path> <guest-path> -c "
import traceback
from shorts_generator.local.transcriber import transcribe_local
try:
    transcribe_local('<guest-path>', language=None)
except Exception:
    traceback.print_exc()
" 2>&1 | tail -25; <guest-path> list 2>/dev/null | grep -i -E 'faster|ctranslate|huggingface|tokenizers'
cd <guest-path> && <guest-path> list 2>/dev/null | grep -i '^av '; <guest-path> install -q "av>=11,<14" > /tmp/pip-av.log 2>&1; echo rc=$?; tail -2 /tmp/pip-av.log; <guest-path> list 2>/dev/null | grep -i '^av '; LOCAL_OUTPUT_DIR=<guest-path> timeout 1500 <guest-path> main.py <guest-path> --mode local --num-clips 1 2>&1 | tail -12; echo "rc=${PIPESTATUS[0]}"
ls -la <guest-path> /inputs 2>&1 | head; wc -l <guest-path>; grep -n -E "credentials_error|testable|checks|expected_returncode|stays_running|def " <guest-path> | head -80; cat <guest-path>
cd <guest-path> && sed -n 48,60p check.py; echo ...; sed -n 653,760p check.py; echo ...; sed -n 856,935p check.py
cd <guest-path> && sed -n 36,47p check.py; sed -n 202,226p check.py; sed -n 1168,1200p check.py; grep -n "CREDENTIALS =\|PREREQUISITE =\|SECRET_NAME =" check.py
cd <guest-path> && grep -rn -i -E "cron|schedul|while True|webhook|--once|--now|sleep\(|time\.sleep|watch" --include=*.py . | grep -v '^./.claude' | head; echo ---; ls -a; cat .gitignore; echo ---; printf 'LOCAL_OUTPUT_DIR=<guest-path>\n' > .env && cat .env && git status --short
cd <guest-path> && PY=<guest-path> && cat > probe.json <<EOF
{"checks":[
 {"check":"credentials_error","kind":"cli","argv":["$PY","main.py","https://www.youtube.com/watch?v=8Ua5lRiePFg","--num-clips","1"],"cwd":"<guest-path>","expected_returncode":1},
 {"check":"credentials_error","kind":"cli","argv":["$PY","main.py","<guest-path>","--mode","local","--num-clips","1"],"cwd":"<guest-path>","expected_returncode":1}
]}
EOF
cat > claims.json <<EOF
[
 {"kind":"claim","claim":"Local mode accepts a direct filesystem path and skips YouTube","source":"In \`--mode local\`, you can pass a \`file://\` URL or a direct filesystem path and skip YouTube entirely","input":"<guest-path>","expected":"local transcription runs on the file (1 segment)","probe_kind":"cli","argv":["$PY","main.py","<guest-path>","--mode","local","--num-clips","1"],"expected_text":"1 segments, 8s of audio","cwd":"<guest-path>"},
 {"kind":"claim","claim":"API mode needs a MuAPI key","source":"For **API mode (default)**: a MuAPI key","input":"YouTube URL without key","expected":"run stops with MUAPI_API_KEY missing","probe_kind":"cli","argv":["$PY","main.py","https://www.youtube.com/watch?v=8Ua5lRiePFg","--num-clips","1"],"expected_text":"MUAPI_API_KEY is not set","cwd":"<guest-path>"},
 {"kind":"claim","claim":"Local mode writes shorts to LOCAL_OUTPUT_DIR","source":"Local mode writes the rendered shorts to","input":"local file with no LLM key","expected":"run reaches highlight ranking, needs OPENAI_API_KEY","probe_kind":"cli","argv":["$PY","main.py","<guest-path>","--mode","local","--num-clips","1"],"expected_text":"OPENAI_API_KEY is not set","cwd":"<guest-path>"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: main.py is a one-shot argparse CLI (single run per invocation, exits). README has no cron, scheduling, loop, webhook, --once or --now. The only while-loop in source is a frame loop in shorts_generator/local/clipper.py and polling sleeps in muapi.py, which are not product cycles.","checks":[]}
EOF
cat > examples.json <<'EOF'
[
 {"kind":"example","claim":"Single video, API mode quickstart","source":"README.md Usage / Single video (API mode — default)","reason":"Needs MUAPI_API_KEY, which is not available in this guest. Ran the documented command with no key; it stopped with 'MUAPI_API_KEY is not set' (exit 1). Covered by the credentials_error check in probe.json."},
 {"kind":"example","claim":"Single video, local mode quickstart","source":"README.md Usage / Single video (Local mode)","reason":"Needs OPENAI_API_KEY or GEMINI_API_KEY for highlight ranking, which is not available. A YouTube URL was not used because only a local file was reachable without a key. Local file transcription ran to completion and wrote a cache .srt before stopping at the missing OPENAI_API_KEY."},
 {"kind":"example","claim":"Batch processing with xargs","source":"README.md Usage / Batch processing","reason":"Each line runs main.py, which needs a MuAPI key (API mode) or an OpenAI/Gemini key (local mode). Not runnable without credentials; the single-run paths above stop at the same missing-key checks."}
]
EOF
for f in probe.json claims.json cycles.json examples.json; do <guest-path> -I -c "import json,sys;json.load(open(sys.argv[1]));print(sys.argv[1],'valid')" $f; done
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && cat > claims.json <<'EOF'
[
 {"kind":"claim","claim":"Local mode accepts a direct filesystem path and skips YouTube","source":"In `--mode local`, you can pass a `file://` URL or a direct filesystem path and skip YouTube entirely","testable":false,"reason":"Needs OPENAI_API_KEY or GEMINI_API_KEY for the highlight-ranking step, which this guest does not have. The path was accepted and local transcription ran on <guest-path> (1 segment, 8s), then the run stopped with 'OPENAI_API_KEY is not set'."},
 {"kind":"claim","claim":"API mode needs a MuAPI key","source":"For **API mode (default)**: a MuAPI key","testable":false,"reason":"Needs MUAPI_API_KEY, which this guest does not have. Ran the documented API-mode command without a key; it stopped with 'MUAPI_API_KEY is not set' (exit 1). Recorded as the credentials_error check in probe.json."},
 {"kind":"claim","claim":"Local mode writes shorts and transcript cache to LOCAL_OUTPUT_DIR","source":"Local transcription is cached as an `.srt` file in `LOCAL_OUTPUT_DIR` using the","testable":false,"reason":"Needs an OpenAI or Gemini key before shorts are rendered. The transcript cache step did run: <guest-path> was written (verified contents) before the missing-key stop."}
]
EOF
<guest-path> -I -c "import json;json.load(open('claims.json'));print('ok')"; cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > /tmp/check1.out 2>&1; echo rc=$?; python3 -I -c "
import json,sys
d=json.load(open('/tmp/check1.out')) if False else None
" ; grep -o '"valid": [a-z]*' /tmp/check1.out; grep -o '"problems": \[[^]]*\]' /tmp/check1.out | head -c 1500
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"needs_credentials","fault_owner":"prerequisite","operation":"Turn a YouTube URL (API mode) or a local video file (local mode) into ranked vertical shorts with python main.py","operation_scope":"Pinned commit 70c5fa96984cbc35b3b76a981a81c676117370ec, Ubuntu 24.04, Python 3.12.3 venv at <guest-path> Verified: install of requirements.txt and requirements-local.txt, ffmpeg, the CLI runs, and local-mode transcription on a generated speech clip (1 segment, 8s, cached .srt). Not verified: highlight ranking, clip rendering, and final shorts, because they need MUAPI_API_KEY (API mode) or OPENAI_API_KEY/GEMINI_API_KEY (local mode), which this guest does not have.","steps":["git init; git remote add origin https://github.com/Anil-matcha/AI-Youtube-Shorts-Generator; git fetch --depth 1 origin 70c5fa96984cbc35b3b76a981a81c676117370ec; git reset --mixed FETCH_HEAD","sudo apt-get install -y python3.12-venv ffmpeg","python3 -m venv <guest-path> && <guest-path> install -r requirements.txt","<guest-path> install -r requirements-local.txt","<guest-path> main.py \"https://www.youtube.com/watch?v=8Ua5lRiePFg\" --num-clips 1  (exit 1: MUAPI_API_KEY is not set)","<guest-path> main.py <guest-path> --mode local --num-clips 1  (after av pin; transcription OK, exit 1: OPENAI_API_KEY is not set)"],"deviations":["README says Python 3.10+; Ubuntu 3.12.3 is used. No deviation in version, only in interpreter choice.","Installed python3.12-venv and ffmpeg via apt (sudo). Installed espeak-ng to create a speech test clip outside the checkout.","requirements-local.txt installs unpinned av, which resolved to 19.0.2. faster-whisper 1.2.1 calls av.open(metadata_errors=...), which fails with TypeError on that version. Substitute: pip install 'av>=11,<14' (resolved to 13.1.0) in the venv. Product source not edited.","Created .env in the checkout with only LOCAL_OUTPUT_DIR=<guest-path> so the cache and outputs stay out of the repo (documented config; .env is gitignored). No keys were written.","No MuAPI, OpenAI or Gemini key was obtained or faked; no mock LLM was substituted.","Claims that need a key are recorded as testable:false with the real prerequisite instead of being replayed as successes.","No product cycle exists (one-shot CLI), so cycles.json has detected:false.","The README's Batch processing example and both quickstarts are recorded as blocked in examples.json."],"stuck_step":"Highlight ranking step (LLM call) in both API mode and local mode, because no MuAPI or OpenAI/Gemini key is available in the guest.","main_blocker":"Missing API keys: MUAPI_API_KEY for API mode, OPENAI_API_KEY or GEMINI_API_KEY for local mode.","plain_failure":"The tool needs paid API keys to do its main work. Without them, it stops before picking any clips. Local transcription works on a test video. The highlight picking and cutting steps were not exercised, so the final shorts were not produced.","suggested_fix":"Provide MUAPI_API_KEY (API mode) or OPENAI_API_KEY/GEMINI_API_KEY (local mode) and rerun the README quickstart. Also pin av<14 (or update faster-whisper) in requirements-local.txt, since the unpinned av breaks local transcription with a TypeError on av 19."}
EOF
<guest-path> -I -c "import json;json.load(open('report.json'));print('report valid')"; ls -la <guest-path>; cd <guest-path> && git status --short; pgrep -fa "main.py|mcp|http.server" | grep -v pgrep || echo "no servers running"
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > /tmp/check2.out 2>&1; echo rc=$?; grep -o '"valid": [a-z]*' /tmp/check2.out; grep -o '"problems": \[[^]]*\]' /tmp/check2.out