by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly does what it claims (download Douyin videos, extract audio, call an ASR and perform segmentation) but has several mismatches between its manifest, README, and code (undeclared credentials and undeclared required binaries), which increases risk and warrants caution before installing.
评估建议
Before installing or supplying credentials, consider the following:
- Missing declarations: the skill requires ffmpeg (declared) but the code also uses 'curl' (spawned) and an optional MINIMAX_API_KEY — 'curl' and MINIMAX_API_KEY are not declared in the skill metadata. Ask the publisher to add MINIMAX_API_KEY to requires.env and declare 'curl' as a required binary or change to a pure-Node HTTP implementation.
- Credential scope: SILI_FLOW_API_KEY will be sent to https://api.siliconflow.cn with...详细分析 ▾
ℹ 用途与能力
The name/description (Douyin no-watermark download + text extraction) matches the code: it fetches Douyin pages, extracts a no-watermark video URL, downloads video, extracts audio, calls an ASR, and performs semantic segmentation. However the SKILL.md claims it uses the OpenClaw built-in LLM for segmentation while the code actually calls an external MiniMax API (api.minimaxi.com). Also the code documents an optional MINIMAX_API_KEY environment variable that is not declared in the skill requirements.
⚠ 指令范围
SKILL.md instructs running node at a specific workspace path and states segmentation uses the built-in LLM, but the included douyin.js makes outgoing HTTP(S) requests to iesdouyin.com, siliconflow.cn, and api.minimaxi.com and spawns external processes (ffmpeg and curl). The instructions do not declare or warn about the external MiniMax call or the use of curl, giving the agent broader network and command execution scope than the manifest communicates.
✓ 安装机制
There is no install spec (instruction-only with an included JS file). That keeps installation footprint small. However the code executes external binaries (ffmpeg and curl) and performs network I/O, so attackers could misuse those execution paths if keys are provided or the code is later modified.
⚠ 凭证需求
The registry metadata requires SILI_FLOW_API_KEY (used for ASR) which is coherent. But the code also reads MINIMAX_API_KEY (optional) and will send text to api.minimaxi.com if present — MINIMAX_API_KEY is not declared in requires.env. The code spawns curl to upload files and post JSON; these elevated network actions are proportional to the stated functionality only if the user expects their audio/text to be sent to those third-party services. The skill does not declare 'curl' as a required binary but uses it, and environment access and network transmission of audio/text to external APIs should be explicitly declared and approved by the user.
✓ 持久化与权限
The skill is not always:true and does not request persistent or cross-skill configuration changes. It does write output files under /tmp by default but does not appear to modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.02026/2/27
Version 2.0.0 introduces major new features and improvements: - 新增支持从视频中提取语音文案（需 API Key），并自动语义分段 - 支持获取无水印视频下载链接及视频下载 - 增加环境变量 SILI_FLOW_API_KEY 用于调用语音转文字服务 - 提供跳过语义分段的选项 --no-segment - 更新使用说明与依赖要求
● 无害
安装命令
点击复制官方npx clawhub@latest install douyin-download-v2
镜像加速npx clawhub@latest install douyin-download-v2 --registry https://cn.longxiaskill.com