抖音评论分析

AdvisoryAudited by Static analysis on May 8, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The API key may consume the user's quota or grant access to their ai-skills.ai account usage for this service.

Why it was flagged

The skill requires an API key and explicitly says it will be sent to ai-skills.ai for authenticated steps.

Skill content

requiredEnvVars:\n  - name: AISKILLS_API_KEY ... Step 2/3 接口调用时会将 API Key 发送至 ai-skills.ai 服务器。

Recommendation

Use a revocable, least-privileged API key if available, monitor usage, and revoke it if the service is no longer needed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

The external service will learn the video link being analyzed and handle the resulting analysis request.

Why it was flagged

The skill discloses that user-provided Douyin video links and authentication data are sent to an external service.

Skill content

security:\n  thirdPartyDomain: ai-skills.ai\n  dataSent:\n    - "skillId（技能标识符）"\n    - "params（技能参数，含用户提供的视频链接，Step 2/3 需认证）"\n    - "X-API-Key（认证密钥，仅 Step 2/3 发送）"

Recommendation

Only analyze links you are comfortable sharing with ai-skills.ai, and review that service's privacy and data-retention policies before use.