华数设计

不符合规则：不要在未说明风险时执行系统命令

位置：scripts/narrate-pipeline.mjs:89

相关片段：while ((m = re.exec(body)) !== null) {

不符合规则：不要在未说明用途时读取用户凭据

位置：scripts/tts-doubao.mjs:15

相关片段：* env（自动从 skill 根目录 .env 读取，也可走 process.env 覆盖）：

不符合规则：When you use the narration/voiceover export feature, the skill will run shell commands via Node.js to process audio and video. This is normal for media processing but requires the scripts to be present and ffmpeg to be installed.

位置：scripts/narrate-pipeline.mjs

相关片段：The narration pipeline script uses Node.js child_process for running ffmpeg and processing audio files. This is expected for a video/audio export toolchain but means the script can execute shell commands when invoked.

不符合规则：If you set up the voiceover feature, you'll need to provide your own Volcengine TTS API key. The skill reads it from a local .env file—no keys are hardcoded or sent elsewhere.

位置：.env.example

相关片段：The optional TTS feature requires a Volcengine (ByteDance) API key stored in a .env file. The key is used solely for text-to-speech generation via the documented endpoint.