Douyin Video Analyst

• Analyzed: May 11, 2026, 5:48 AM
• Findings: 0
• Version: 1.0.1
• Hash: 07037ac29729e247ce2bfba4b3ca79615bee7aa610a6aa14511143c2857ed188
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: douyin-video-analyst Version: 1.0.1 The skill bundle contains instructions and Python scripts in SKILL.md and troubleshooting.md that programmatically read sensitive configuration files (~/.cursor/mcp.json and ~/.claude.json) to extract API keys and environment variables. While this is intended to verify the setup for the 'douyin-mcp' tool, the practice of reading and printing local credential files to the agent's context is a high-risk behavior that could lead to accidental exposure of secrets.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Concern

What this means

API keys for SiliconFlow or Alibaba Bailian could be exposed in logs or chat context, enabling unauthorized usage or billing impact.

Why it was flagged

The setup examples store DOUYIN_API_KEY or DASHSCOPE_API_KEY inside cfg.env, so this troubleshooting command can print actual API key values into the agent/tool transcript.

Skill content

print(f"Found in {path}:", json.dumps(cfg, indent=2, ensure_ascii=False))

Recommendation

Do not print full MCP configs. Redact env values, show only key names or presence checks, and ask the user before reading local credential files.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

The transcript extraction behavior depends on third-party package code that is not included in the reviewed skill artifacts.

Why it was flagged

The skill depends on globally installed mcporter and an external douyin-mcp server package; the v1.2.0+ setup uses the latest package name without a pinned version.

Skill content

如未安装：`npm install -g mcporter` ... "command": "uvx", "args": ["douyin-mcp-server"]

Recommendation

Install only from trusted sources, prefer pinned versions, and review the MCP server package before giving it API keys.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Video URLs and related processing requests may be sent to external services during transcript extraction.

Why it was flagged

The workflow sends Douyin video links through an MCP server using a provider API key. This is aligned with transcription, but the data boundary depends on the external MCP server and provider.

Skill content

DASHSCOPE_API_KEY="<key>" mcporter call douyin-mcp.extract_douyin_text \
  share_link="https://www.douyin.com/video/<video_id>" 2>&1

Recommendation

Confirm the MCP server and API provider are acceptable for the videos being analyzed, and avoid using sensitive or private links unless the provider is trusted.