digital-human-koubo

mediumChanges the agent's instructions or settings

Editing CLAUDE.md, AGENTS.md, memory files, hooks or MCP settings lets a tool keep steering the agent even after it's removed.

README.md:94 | **Codex** (CLI / desktop) | `~/.codex/skills/` | `codex mcp add` | ✅ | ✅ Expected to work (same scripts) |

mediumChanges the agent's instructions or settings

Editing CLAUDE.md, AGENTS.md, memory files, hooks or MCP settings lets a tool keep steering the agent even after it's removed.

README.zh-CN.md:94 | **Codex**（CLI / 桌面） | `~/.codex/skills/` | `codex mcp add` | ✅ | ✅ 预期可用（同一套脚本） |

mediumDownloads programs or archives while running

Files fetched at run time weren't part of this check, and they can change at any time.

skills/digital-human-koubo/scripts/doctor.sh:30 [ -n "$M" ] && ok "whisper 模型 $(basename "$M")" || need "whisper 模型 ggml-medium-q5_0.bin" "逐段回听、逐字对齐" "下载到 ~/models/：curl -L -o ~/models/ggml-medium-q5_0.bin ht

mediumSuggests switching the global npm registry to a third-party mirror

When npm cannot connect, the agent is told to run `npm config set registry https://registry.npmmirror.com`. This persistently changes the user's global npm configuration so that all future package installs come from a third-party mirror. The mirror is legitimate and widely used in China, but the change outlives this tool and should be made only with explicit user consent.

skills/digital-human-koubo/references/install.md:41 Remotion 不用单独装：`scripts/new_edit.sh` 起工程时会先从本机已有的 Remotion 工程克隆，没有才 `npm install`；npm 源连不上时换镜像 `npm config set registry https://registry.npmmirror.com`。

mediumCopies node_modules from arbitrary existing Remotion projects on the machine

The setup scripts are told to clone node_modules from whatever Remotion project they find locally before falling back to npm install. That pulls in unverified, possibly stale or tampered dependencies from other projects, and it means the scripts look through the user's directories for such projects. The scripts doing this (new_edit.sh, setup_engine.sh) were not included in the bundle, so how far they search could not be checked.

skills/finance-explainer/SKILL.md:23 - 引擎：`bash scripts/setup_engine.sh <项目目录>`（复制 templates/engine，node_modules 优先从本机已有 Remotion 项目 `cp -c` 克隆，失败再 npm install）。

skills/digital-human-koubo/references/edit-styles.md:3 几个模板都是 Remotion 工程，`node_modules` 用 `cp -cR` 从任一现有工程克隆（npm 源常 SSL 失败）。时间轴全部来自逐字对齐（tl.json / timeline.json），改文案后重跑对齐即可。

skills/digital-human-koubo/references/install.md:41 Remotion 不用单独装：`scripts/new_edit.sh` 起工程时会先从本机已有的 Remotion 工程克隆，没有才 `npm install`；npm 源连不上时换镜像 `npm config set registry https://registry.npmmirror.com`。

mediumLarge amount of locally executed code not available for review

The workflow runs many local scripts automatically: doctor.sh, new_edit.sh (which also auto-runs make_assets.py), build_tasks, rangedl, assemble, align, cutout_video, patch_words, lin_mix, make_cover, and the finance-explainer research.py and fetch_stock.py. A Swift helper is compiled on first use. Of these, only doctor.sh was included in the bundle. The others could hide network calls or reads of the key files, and they need a human look before listing.

skills/digital-human-koubo/SKILL.md:25 2. **本机环境**（要剪辑时才需要）：`bash scripts/doctor.sh`。有的打 ✓ 不提；缺的它会按 macOS / Windows / Linux 列出多种装法。系统软件让用户自己装，Python 包可以在用户同意后帮装。

README.md:168 `new_edit.sh` also runs this automatically for every new project. For a better soundtrack, drop any track you have the rights to at `<project>/public/music/bgm.

THIRD_PARTY.md:12 | Apple Vision | macOS system framework | Apple SDK | Person segmentation for the text-behind effect (`scripts/personmask.swift`, compiled locally on first use;