myskill

获取抖音热榜/热搜榜数据，包含热门视频、挑战赛、音乐等多领域热门内容，并输出标题、热度值、跳转链接及封面图（如有）。

This package appears to do what it says: local Node scripts fetch and format Douyin hot-trend data and save it to files. Before installing, ensure Node.js is available (the package expects `node`), and run the code in a sandbox or review it yourself. Note the registry metadata omitted the Node requirement — that's a minor inconsistency. The cron/cron-job file hardcodes a Telegram chat_id but no token; if you plan to enable automatic delivery to Telegram or other channels, implement secure credential handling (do not hardcode tokens) and limit permissions. Also be aware that scraping public web endpoints can trigger rate-limiting or anti-bot protections; use responsibly and respect terms of service. If you need higher assurance, ask the publisher for a canonical source/homepage or signed releases.

Type: OpenClaw Skill Name: npdouyin-hot-trend Version: 1.0.0 The skill bundle contains scripts for scraping Douyin trends but includes a hardcoded Telegram chat ID ('8428610733') in 'cron-job.js' and 'daily-hot-trend-output.json', which could result in data being sent to a third party if used with automated messaging tools. Additionally, 'cron-job.js' and 'scripts/get-hot-trend.js' utilize 'execSync' to execute internal shell commands; while not explicitly malicious in this context, this pattern is a common vector for command injection if inputs are not strictly controlled.