Security checks across malware telemetry and agentic risk
The skill has a legitimate Douyin transcription purpose, but its helper can run unsafe shell commands from supplied links or paths and its privacy/offline claims are overstated.
Install only if you are comfortable with local shell execution and networked Douyin-link processing. Use trusted links and file paths only, treat the privacy/offline claims as incomplete, and prefer a revised version that removes shell=True, passes subprocess arguments as lists, validates inputs, and clearly documents output locations and cleanup.
def run_command(cmd, cwd=None, timeout=300):
"""运行命令并返回输出"""
try:
result = subprocess.run(
cmd,
shell=True,
capture_output=True,66/66 vendors flagged this skill as clean.