MCBAI Douyin Dubber

Auto-dub Douyin/TikTok videos into any language using a fully local pipeline: download with Playwright Chromium + Douyin cookie → transcribe with Whisper → t...

This skill appears to do what it says, but it requires a Douyin session cookie file which effectively grants access to your Douyin account. Only use a throwaway/test account as the author recommends, store the cookie file locally (do not commit it to version control), and rotate/revoke the cookie after use. Review the included scripts yourself or run the skill inside an isolated environment (container or VM) if you have any doubt. If you plan to use cloud TTS (ElevenLabs), provide a scoped key and monitor usage. If you want higher assurance, paste the full script into a quick review (or run it in a sandbox) to confirm there are no hidden network calls beyond expected TTS/CDN accesses.

Type: OpenClaw Skill Name: mcbai-douyin-dubber Version: 1.0.4 The skill implements a complex video dubbing pipeline that handles sensitive Douyin session cookies and ElevenLabs API keys. While the behavior aligns with the stated purpose, the script employs high-risk patterns including the dynamic generation and execution of temporary Python scripts (e.g., pw_capture.py and an edge-tts wrapper) via subprocesses. Additionally, it constructs complex FFmpeg filter strings which, despite basic escaping attempts, represent a potential injection surface. These capabilities are functionally justified but meet the threshold for suspicious behavior due to the inherent risks of executing generated code and shell commands.