On-screen text
coba analisa tentang ini
Started by hermes_rumah_fri
Alasan Kenapa
Personal AI Agent itu
WAJIB!!
@hermes_rumah_fri
GitHub
GitHub - harry0703/MoneyPrinterTurbo: 利用AI大模型，一键生成高清短视频
一键生...
利用AI大模型，一键生成高清短视频 Generate short videos with
one click using AI LLM. - harry0703/MoneyPrinterTurbo
harry0703/
MoneyPrinterTurbo
利用AI大模型，一键生成高清短视频 Generate short
videos with one click using AI LLM.
38
Contributions
2
Likes
60K
Views
9K
Shares
hermes_rumah_fri APP 3:46 PM
web_extract: "https://github.com/harry0703/MoneyPrinterTurbo"
web_search: "MoneyPrinterTurbo harry0703 Github an..."
web_extract: "https://raw.githubusercontent.com/har..."
web_extract: "MoneyPrinterTurbo AI video generation..."
terminal: "curl -sL https://aitoolly.com/ai-news/article/..."
terminal: "curl -sL https://github.com/repo... (x13)
@Agent FriHand 3:56 PM
Security Audit - MoneyPrinterTurbo
Aku udah baca semua 39 file Python + config + Dockerfile. Ini hasil audit-
Verdict: CLEAN - Aman
Gak ada yang aneh-aneh. Ini kode yang bersih dan well-main...
Yang Udah Diperiksa
##### 1. 盗Telemetry / Data Exfiltration -> NONE
- Gak ada Google Analytics, Firebase, Sentry, Datadog, Mixpanel.
- Streamlit telemetry juga udah di-disable (--browser-gatherer)
- Satu-satunya outbound network call: Pexels API, Pixabay (stock fo
##### 2. Code Injection / eval / exec -> NONE
Gak ada eval(), exec(), pickle, atau ->import
subprocess cuma dipakai 1x, itupun buat ffmpeg concat
##### 3. Path Traversal Protection -> SOLID
- File app/utils/file_security.py punya fungsi resolve
- Pakai os.path.realpath() untuk resolve symlink & relative path
- Pakai os.path.commonpath() untuk validasi boundary
- Tolak path yang escape dari direktori yang diizinkan
- Ini lebih robust daripada mayoritas project open-source
##### 4. API Key Handling -> NO HARDCODED KEY
- Semua API key dikonfigurasi via config.toml (dan
- Tidak ada hardcoded key di source code
- config.example.toml dikasih ke git, config.toml (dan
- Support multiple API keys dengan round-robin
##### 5. TLS / Network Security -> GOOD
- TLS certificate verification default ON (tls_verify=True)
- Kalau dimatikan, keluar warning eksplisit di log
- Support proxy config untuk lingkungan enterprise (1/3)
##### 6. g4f Provider -> HEAVILY WARNED + DISABLED
Ini satu-satunya red flag tapi udah di-handle dengan ba
# if llm.py:
# if not config.app.get("enable_g4f", False):
# raise ValueError(
# "g4f provider is disabled by default before
# "reverse-engineered third-party endpoint"
- g4f (GPT4Free) pakai reverse-engineered endpoint tapi data
- Tapi default = disabled, dan ada big fat warning kalau mau di-
- Bahkan package-nya nya optional dependency (uv sync, uv-feed)
##### 7. Upload-Post (TikTok/Instagram Cross-post) -> OK
- Fitur auto-upload ke TikTok/Instagram via third-party API
- Default = disabled (upload_post_enabled = false)
- Perlu API key + username eksplisit untuk aktif
- Aman - tapi kalau kamu enable, video kamu dikirim ke server
##### 8. Dockerfile -> CLEAN
- Pakai official python:3.11-slim-bullseye base image - bukaan
- Chinese mirror (Aliyun/Tsinghua) buat apt & pip - wajar kalau
chmod 777 di container - agak terlalu permisif tapi itu di
##### 9. Dependencies -> STANDARD
- moviepy, streamlit, fastapi, openai, edge-tts, open-ai
- Semua dari PyPI official
Minor Concerns (Low Risk)
| Issue | Risk | Note |
|---|---|---|
| g4f kalau di-enable | Medium | Reverse-engineered endpoint |
| Upload-Post third-party | Low | Opt-in, tapi data video dikirim ke se
| Redis tanpa password default | Low | redis_password = ""
| Docker chmod 777 | Low | Di dalam container, bukan host file
| Edge TTS | Very Low | Pakai Microsoft Edge TTS gratis (bukan
Kesimpulan
MoneyPrinterTurbo itu AMAN. Gak ada malware, gak ada spyware, gak ada
stars, kode bersih, security practices cukup baik untuk ukuran project
Satu-satunya caution: jangan enable g4f provider. Pakai OpenAI,
Mau install & tes langsung, bos? Atau ada kekhawatiran lain? (3/3)
@Agent FriHand 3:58 PM
okkey coba setup deh, mau lihat hasil videonya nanti kayak apa
hermes_rumah_fri APP 3:58 PM
terminal: "curl -sL https://api.github.com/repos/harry0703/MoneyPrinterTurbo/contents/app/services"
terminal: "echo "==== Python ====" && python3 -c "import sys, json; data = json.load(sys.stdin); print(f'{[i[\"name\"] for i in data if i[\"type\"]==\"file\"]}')" < "/tmp/a.json"
terminal: "sudo apt-get update -qq && sudo apt-get install -y ffmpeg"
ImageMagick belum keinstall dan perlu sudo. Lanjut dulu
terminal: "cd ~/hermes-workspace && git clone https://github.com/harry0703/MoneyPrinterTurbo.git"
terminal: "updating 5 task(s)"
ImageMagick belum keinstall dan perlu sudo.
terminal: "cd ~/hermes-workspace && git clone https://github.com/harry0703/MoneyPrinterTurbo.git"
terminal: "updating 4 task(s)"
terminal: "cd ~/hermes-workspace && git clone https://github.com/harry0703/MoneyPrinterTurbo.git"
terminal: "updating 4 task(s)"
