深度拆解抖音视频，自动生成包含数据、结构、视觉、文案的完整分析报告。

This skill appears to do what it says, but note these important considerations before installing or using it: - Privacy/data exfiltration: The skill explicitly uploads selected keyframes (Base64) and audio segments to Zhipu (open.bigmodel.cn). Only give a ZHIPU_API_KEY you trust and avoid sending media you cannot share with that service (sensitive/personal content, copyrighted material, or data covered by legal/contractual restrictions). - Costs and rate limits: Remote API calls (vision + ASR) can incur cost or rate limits. Confirm your ZHIPU account, quotas, and billing implications. - Installation downloads: Running the provided install (npx playwright install --with-deps chromium) and installing npm deps will download large browser binaries and packages — run in an environment with sufficient disk space and bandwidth. - Run in a sandbox: Because this package executes downloads and shell commands (ffmpeg, yt-dlp, child_process usage), test it first in an isolated VM or container if you have any doubt about running code from an unknown source. - Inspect scripts before use: If you want more assurance, open scripts/analyze.js and verify it only orchestrates the listed modules and that no additional remote endpoints are contacted beyond open.bigmodel.cn and the normal scraping/downloading endpoints. - Alternatives: If you need purely local analysis, do not set ZHIPU_API_KEY and modify the code to skip remote analysis (or inspect/implement a local-only path) to avoid uploading media. If you want, I can help locate the exact lines where uploads happen, suggest a minimal local-only change, or produce a checklist of commands to run this in a container safely.

Type: OpenClaw Skill Name: douyin-video-analyzer Version: 3.7.4 The skill bundle implements a Douyin video analysis tool that downloads media using yt-dlp/Playwright and sends frames/audio to Zhipu AI (open.bigmodel.cn). It is classified as suspicious due to multiple instances of shell command construction using 'child_process.exec' with external inputs (e.g., video URLs and file paths in lib/video-downloader.js, lib/audio-processor.js, and lib/frame-extractor.js), which creates a high risk of Remote Code Execution (RCE) via shell injection. While these vulnerabilities are critical, the code's behavior appears consistent with its stated purpose, and no evidence of intentional malice or unauthorized data exfiltration was identified.