抖音无水印视频下载和文案提取工具

This skill appears to implement Douyin downloading and transcription, but check the following before installing: - Be aware audio is uploaded to https://api.siliconflow.cn for transcription. Do not use the skill on sensitive audio unless you trust that service and its privacy policy. - SKILL.md and the code require an API key (DOUYIN_API_KEY or API_KEY) but the registry metadata does not declare it — expect to provide that secret manually. Limit the key's scope if possible. - The code spawns both ffmpeg and ffprobe; ensure those binaries are available (ffprobe may be part of ffmpeg on some systems). The metadata only listed ffmpeg — consider this a small mismatch. - The skill writes video/audio/transcript files to the output folder you choose; run it in a sandboxed or disposable workspace if unsure. - The repository/homepage is listed (https://github.com/yzfly/douyin-mcp-server). If you plan to use it, review the full source there and the remainder of douyin.js (the provided file was truncated in the package) so you can confirm no unexpected behavior exists. If you want higher assurance, ask the publisher to update the metadata to declare the required env vars and to provide a full audit of network endpoints and any additional code paths not visible in the truncated file.

Type: OpenClaw Skill Name: douyin-downloader-nodejs Version: 1.0.0 The skill is designed for legitimate video downloading and transcription. However, it is classified as suspicious due to significant vulnerabilities. The `douyin.js` script uses `child_process.spawn` to execute `ffmpeg` and `ffprobe` with file paths constructed from user-controlled input (`outputDir` and derived `video_id`). This poses a shell injection risk if these inputs contain malicious metacharacters. Additionally, the `outputDir` is directly used in `path.join` for file writing, creating a path traversal vulnerability that could allow writing files to arbitrary locations on the filesystem. There is no evidence of intentional malicious behavior like data exfiltration or backdoors.