抖音无水印视频下载和文案提取工具

This skill is functionally consistent with a Douyin downloader/transcriber, but there are important mismatches you should consider before installing: - The SKILL.md declares only SILI_FLOW_API_KEY and ffmpeg, but the code also uses MINIMAX_API_KEY (undeclared) and spawns curl (an undeclared required binary). Expect the script to call external services at https://api.siliconflow.cn and https://api.minimaxi.com. - SKILL.md states it uses the OpenClaw built-in LLM for segmentation, but the code calls an external MiniMax API if MINIMAX_API_KEY is set. Ask the author to clarify whether segmentation uses an internal model or an external provider, and to document MINIMAX_API_KEY if required. - Before using, verify you have (or are willing to permit) ffmpeg and curl on the host, and that you are comfortable that audio and extracted text will be sent to the listed external endpoints. Consider creating/using API keys with limited scope or a disposable key. - If you need higher assurance, review the full douyin.js file locally (it was included) and run the script in a sandboxed environment (container or VM) to observe network calls and file writes. If the author provides an updated SKILL.md that documents MINIMAX_API_KEY and adds curl to required binaries (or modifies the code to use the platform's internal LLM as documented), that would reduce the current concerns.

Type: OpenClaw Skill Name: douyin-download Version: 1.2.0 The skill bundle provides a utility to download Douyin videos, extract audio, transcribe it using SiliconFlow API, and optionally segment the text using MiniMax API or OpenClaw's internal LLM. All operations, including network requests to Douyin, SiliconFlow, and MiniMax, and local file system operations (downloading, saving, deleting temporary files), are directly aligned with the stated purpose. The use of `child_process.spawn` with an array of arguments for `ffmpeg` and `curl` commands, along with `path.join` for file paths and basic sanitization of video titles, significantly mitigates common shell injection and path traversal vulnerabilities. There is no evidence of data exfiltration to unauthorized endpoints, persistence mechanisms, obfuscation, or prompt injection attempts against the OpenClaw agent in `SKILL.md`.