抖音视频快速转文字

This skill appears to do what it claims (local Whisper transcription), but proceed with caution. Key points: - The script calls 'mcporter' (douyin-mcp) to parse Douyin links but the SKILL.md didn't list mcporter as a required tool — make sure you install and trust mcporter before use. - The script builds shell commands with user-supplied values (share links and extracted URLs) and runs them with shell=True. That is a real command-injection risk if you or others pass crafted inputs. Prefer running it only on trusted inputs or run the script in an isolated environment (container/VM) until the code is patched to use subprocess with argument lists (no shell) and proper input validation/escaping. - Transcripts are saved under ~/.openclaw/workspace/douyin-transcripts; confirm you are comfortable with this persistent storage location. - If you plan to run this on a multi-user or server environment, review and harden the script (remove shell=True, validate/sanitize inputs, and explicitly require mcporter in documentation) before enabling autonomous invocation. If you want, I can suggest a small patch to the script that removes shell=True and safely constructs subprocess calls, and I can point out exactly where to add mcporter as a documented dependency.