by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill is simple and appears to do what it says (use curl with a Referer to download Douyin video files), but be aware of a few issues before installing:
- The SKILL.md assumes curl and a config.json but the metadata doesn't declare them. Confirm curl is available and inspect any config.json the agent might read; otherwise the agent could try to read arbitrary local files.
- The skill asks you to obtain the 'real playback URL' via Douyin API or third‑party tools — that will cause network re...详细分析 ▾
ℹ 用途与能力
The skill purpose (download Douyin videos by sending curl with a Referer) is coherent with the SKILL.md. However the metadata declares no required binaries while the instructions rely on curl, and the README mentions automatically using a config.json (no config paths declared) — minor mismatches between claimed requirements and actual instructions.
⚠ 指令范围
The instructions are mostly limited to constructing and running a curl command, which is in-scope. But they also state '自动使用config.json中的配置参数' and instruct obtaining the 'real playback URL' via Douyin API or third‑party tools. The skill does not declare any config paths; that ambiguity could cause the agent to look for or read a local config.json or to query external services to locate real video URLs.
✓ 安装机制
Instruction-only skill with no install spec or code files — lowest risk from installed artifacts.
ℹ 凭证需求
No environment variables or credentials are requested, which is appropriate. Still, the SKILL.md's reference to a local config.json and to third‑party tools increases the chance the agent will access local files or external services despite no declared permissions.
✓ 持久化与权限
No special persistence or elevated privileges requested; always:false and the skill is user-invocable only (normal).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install gnview-douyin-video-download
镜像加速npx clawhub@latest install gnview-douyin-video-download --registry https://cn.longxiaskill.com镜像同步中