抖音无水印视频下载和文案提取工具

Before installing or supplying credentials, consider the following: - Missing declarations: the skill requires ffmpeg (declared) but the code also uses 'curl' (spawned) and an optional MINIMAX_API_KEY — 'curl' and MINIMAX_API_KEY are not declared in the skill metadata. Ask the publisher to add MINIMAX_API_KEY to requires.env and declare 'curl' as a required binary or change to a pure-Node HTTP implementation. - Credential scope: SILI_FLOW_API_KEY will be sent to https://api.siliconflow.cn with your audio file. If you set MINIMAX_API_KEY it will be sent to https://api.minimaxi.com. Only provide API keys you trust and that are scoped/limited; avoid sharing high-privilege or billing-sensitive keys. - Network & file-exfiltration risk: the skill uploads audio files to external services (ASR and segmentation). While that matches the declared purpose, it means sensitive audio/text could be transmitted. If you must process sensitive content, run the skill in an isolated environment (container or VM) or review/modify the code to remove external calls. - Behaviour mismatch: SKILL.md claims use of an internal LLM for segmentation but the code calls MiniMax. Confirm with the author which model/service will actually be used. - Operational recommendation: run the script in a sandboxed environment first, inspect/verify the code yourself (or ask for a signed/published source), and monitor outbound network requests during a test. If you don't want external calls beyond Silicon Flow, remove or disable the MiniMax call. - Legal/ethical note: downloading videos from platforms may violate terms of service or copyright — ensure you have rights to download and process the content. If you want, I can produce a short patch suggestion to (a) remove undeclared 'curl' usage by using Node HTTPS for API calls, (b) add explicit checks and warnings when MINIMAX_API_KEY is missing or present, and (c) surface required binaries/env variables clearly in SKILL.md.

Type: OpenClaw Skill Name: douyin-download-v2 Version: 2.0.0 The skill `douyin-download-v2` is designed to download Douyin videos, extract audio, transcribe speech using SiliconFlow API, and optionally segment text using MiniMax API. The `SKILL.md` provides clear instructions without any prompt injection attempts. The `douyin.js` script uses `child_process.spawn` with an array of arguments for `ffmpeg` and `curl` commands, which significantly mitigates shell injection risks. It accesses `SILI_FLOW_API_KEY` and `MINIMAX_API_KEY` from environment variables for legitimate API calls to `api.siliconflow.cn` and `api.minimaxi.com`, which aligns with its stated purpose. File operations are confined to `/tmp` or user-specified directories, and there is no evidence of data exfiltration to unauthorized endpoints, persistence mechanisms, or other malicious behaviors.