📦 Download Tool — 视频下载
v1.1.0一键下载 YouTube、TikTok、小红书、抖音等平台高清视频，支持多格式与批量任务，自动去水印，本地存储快速回看。
0· 181·0 当前·0 累计
by 下载技能包
最后更新
2026/3/20
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill delegates downloads to an external paid backend (https://www.datamass.cn). Before installing: (1) Understand that you must create and store an API key in ~/.openclaw/config.json — the code will send that key to the datamass service (X-Api-Key) and will also send the video URL; do not store other secrets in that file. (2) Expect billing and retention: the SKILL.md states downloaded files are stored in OSS for 24 hours and the service charges points — review pricing and privacy on the p...详细分析 ▾
⚠ 用途与能力
The skill's declared description (video downloader) matches the code and instructions: both call a remote API to create download tasks and poll status. However, the registry metadata states no required config paths or credentials, while SKILL.md and the scripts require ~/.openclaw/config.json with a download_tool_api_key and optionally download_tool_base_url. That mismatch between metadata and runtime requirements is an incoherence that users should be aware of.
ℹ 指令范围
SKILL.md and the included scripts confine actions to the stated purpose: they read ~/.openclaw/config.json for an API key/base_url, POST the provided video URL to the service, poll status, and print an OSS download URL. The scripts load the entire JSON config file into memory (not just the single key), which could expose any other secrets present in that file to in-process memory, though the code only sends the API key and the video URL to the configured backend. No other system paths, env vars, or unexpected endpoints are referenced.
✓ 安装机制
There is no install spec; the skill is instruction-plus-scripts only. No external archives or third-party packages are fetched at install time. This is a low-risk install mechanism.
⚠ 凭证需求
The skill legitimately requires an API key for the external service and optionally a base URL for self-hosting. Those are declared in SKILL.md (and used by the code) but the skill's registry metadata indicated no required config paths or credentials. Requiring users to place an API key in ~/.openclaw/config.json is reasonable for the service, but the metadata omission is a discrepancy and the API key is a sensitive secret that will be sent to the remote backend (as X-Api-Key).
✓ 持久化与权限
The skill does not request always:true and does not modify agent-wide settings. It can be invoked autonomously (platform default), which is expected for skills. It does not attempt to change other skills' configs or system-wide files beyond reading ~/.openclaw/config.json.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/19
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install download-tool
镜像加速npx clawhub@latest install download-tool --registry https://cn.longxiaskill.com