当用户想要**下载抖音视频**、**下载B站视频**、**解析无水印直链**、**提取最高画质视频**、**把视频下下来**、**保存抖音/B站视频**时自动触发。 专门处理哔哩哔哩（Bilibili/B站）和抖音（Douyin）的任意视频链接（包括短链 b23.tv、douyin.com、bilibili.co...

This skill appears to implement video downloading for Bilibili and Douyin as stated, but it makes significant environment changes at runtime: it will auto-run pip installs (and may modify setuptools), download Playwright chromium and ffmpeg, create a virtualenv in a directory outside the skill folder, and restart in that venv. Those actions can modify your Python environment, write files to disk, and perform network downloads. Before installing or running it consider: - Do not run in a production or sensitive host. Prefer an isolated sandbox/container or disposable VM. - Review the code (ensure_package, env_manager, and top-level imports) line-by-line; note that many installs happen at module import time. - If you must use it on a persistent host, change VENV_DIR to a skill-local path, remove or disable automatic setuptools downgrades, and avoid top-level pip/playwright installs (move them to an explicit, user-approved setup step). - Expect downloads (chromium, ffmpeg, pip packages) and filesystem writes (logs, downloads, venv). - The unicode-control-chars finding in SKILL.md is a prompt-injection warning — be cautious with automatic enabling or trusting external documentation. If you want help producing a safer checklist or a sanitized version of this skill that only runs in a local ephemeral environment, I can suggest concrete code edits (e.g., remove top-level installs, use a local venv path, require explicit user consent before downloads).

Type: OpenClaw Skill Name: link-resolver-engine Version: 1.0.6 The skill bundle is a functional video downloader for Bilibili and Douyin. It features a robust environment setup process, including automated virtual environment creation, dependency management via pip (using the Tsinghua mirror), and the automatic installation of FFmpeg and Chromium. The core logic uses Playwright for dynamic content scraping and the Bilibili/Douyin APIs to retrieve high-quality, watermark-free video streams. All high-risk operations, such as subprocess execution for video merging and network requests for media downloading, are strictly aligned with the stated purpose. No evidence of data exfiltration, malicious persistence, or prompt injection was found across the analyzed files (video_snapper.py, bilibili_video.py, douyin_video.py, etc.).