Douyin Video Transcribe
Security checks across malware telemetry and agentic risk
Overview
The transcription purpose is plausible, but the skill can start a persistent third-party Docker ASR service and contains under-declared cloud/API-key fallback paths.
Review the scripts before installing. Only use this skill if you are comfortable with Docker being started, pin or manually run the Whisper container yourself, avoid configuring cloud API keys unless you want cloud transcription, and clear any temporary audio/transcript files after use.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill may pull and execute external container code on the user's machine, not just process a transcript.
When the local ASR service is not ready, the helper can execute Docker to create a container from a third-party image tagged latest.
DOCKER_IMAGE = "onerahmet/openai-whisper-asr-webservice:latest" ... cmd = ["docker", "run", "-d", "-p", "9000:9000", ... self.DOCKER_IMAGE]
Require explicit user approval before creating containers, pin the Docker image by digest/version, and document the runtime dependency clearly.
A background ASR service may remain active and listening on port 9000, consuming resources or exposing a local service longer than expected.
The helper starts an existing container or creates a new detached container, which can keep running beyond the transcription task.
if container_status in ("exited", "created"): ... ["docker", "start", self.CONTAINER_NAME] ... ["docker", "run", "-d", "-p", "9000:9000", ...]Make persistence opt-in, bind the service to localhost only where possible, and provide clear stop/removal instructions.
Users may not realize the skill can use cloud ASR account credentials or API quota if those keys are present in local config.
The script reads local OpenClaw config and optional cloud API keys, while the registry metadata declares no primary credential or required config paths.
DEFAULT_CONFIG_PATH = Path.home() / ".openclaw" / "skills" / "douyin-config.json" ... self.config.get("sili_flow_api_key") ... self.config.get("dashscope_api_key")Declare all optional credentials/config paths in metadata and require an explicit provider choice before using API keys.
If cloud keys are configured and local transcription fails, selected audio/video content could be handled by an external provider unexpectedly.
The code advertises automatic fallback to cloud transcription providers, but the provided main metadata/SKILL excerpt does not clearly define provider endpoints, consent, retention, or data boundaries.
支持多种转录方式：... 2. 硅基流动 API（云端） 3. 阿里云百炼 API（云端） ... 自动 fallback
Default to local-only transcription unless the user explicitly opts into a named cloud provider, and document what data is sent and retained.
Cloud transcription paths may fail, or Python may resolve similarly named modules from outside the reviewed package.
The cloud provider helper modules referenced by the script are not present in the supplied file manifest, so the credential and upload behavior for those paths cannot be reviewed.
from sili_flow_api import SiliFlowASR ... from dashscope_api import DashScopeASR
Include the referenced helper files in the package, pin any dependencies, or remove the cloud fallback paths until they can be reviewed.