zc-douyin-xiazai-txt

抖音无水印视频下载与文案提取工具，使用本地 ffmpeg 与 Whisper 完成下载、音频提取和文字转写，可选语义分段。

This skill mostly does what its description says, but it has multiple red flags you should consider before installing or running it: (1) The code assumes Windows and an Administrator user (hardcoded C:\Users\Administrator paths and a hardcoded ffmpeg executable). If your machine is different, the script may fail or write files in unexpected places. (2) SKILL.md examples reference inconsistent skill folder names — packaging looks sloppy; review the douyin.js file yourself before running. (3) Prefer versions that call 'ffmpeg' and 'whisper' from PATH or allow configuring binary and output paths; if you proceed, run in a controlled directory (not as Administrator), inspect/change the hardcoded paths to safe locations, and verify external network calls are only to expected Douyin endpoints. If you need higher assurance, ask the author to remove hardcoded Administrator paths, add configurable paths, and fix the usage documentation inconsistency.

Type: OpenClaw Skill Name: zc-douyin-xiazai-txt Version: 1.0.0 The skill provides Douyin video downloading and transcription functionality as described, but it contains hardcoded absolute file paths targeting the 'C:\Users\Administrator' directory for both the ffmpeg executable and the default output workspace in 'douyin.js'. While the script's logic (using child_process.spawn to run ffmpeg and whisper) is functionally aligned with its purpose, the reliance on hardcoded privileged system paths and shell execution without robust path sanitization is a risky practice. No clear evidence of intentional data exfiltration or malicious backdoors was found, but the specific environment targeting warrants caution.