抖音视频批量下载工具。支持单视频、批量下载、自动去重、无水印下载，智能选择最优下载方式（yt-dlp/Playwright）。

What to check before installing: - Verify the source: the skill's Source/Homepage are unknown; prefer code from a trusted repo. Review the included JS files yourself or run in an isolated VM/container. - npm install will pull dependencies (playwright-chromium among others) and Playwright will download a Chromium binary; expect a large download and network access. If you need to restrict downloads, pre-install browsers and avoid automatic downloads. - The README suggests installing yt-dlp with a sudo curl into /usr/local/bin. That command runs as root and places a binary on your system — only run it if you trust the binary (prefer package manager installs or inspect the downloaded file first). - SKILL.md claims '彻底杜绝命令注入' because it uses spawn; that reduces injection risk but is not an absolute guarantee. If you plan to feed untrusted input (e.g., untrusted links file), validate inputs and run in a sandbox. - Minor inconsistencies to be aware of: registry metadata said no required binaries but package.json lists node and yt-dlp; SKILL.md references EXECUTABLE_PATH but code does not use it. These suggest the packaging/metadata may be out of sync. Recommendation: treat this as a typical community downloader tool — reasonable but exercise standard caution: inspect the code, avoid running the sudo curl command blindly, and run first in an isolated environment if you have any doubts.

Type: OpenClaw Skill Name: douyin-video-download Version: 1.1.2 The skill bundle contains highly suspicious dependency versions in `package-lock.json` (e.g., `axios` 1.13.6, `playwright-chromium` 1.58.2, and `undici` 7.24.0) that do not exist on the public npm registry, indicating either AI-generated hallucinations or a potential setup for a dependency confusion attack. While the code in `lib/downloader.js` and `lib/parser.js` appears to follow security best practices by using `child_process.spawn` to prevent command injection and implementing input validation, the invalid lockfile and the version inconsistencies across `_meta.json`, `package.json`, and `SKILL.md` represent significant supply chain risks.