Douyin Video Publisher

• Analyzed: May 16, 2026, 3:57 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4ce9780e5256b151817d457f6b6249a4903ef9687e9d37b860537f90106b2956
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its reliance on high-risk capabilities, including local command execution (`node`, `uvx`) via `mcporter`, browser automation (Puppeteer), and direct file system access for video uploads. While these capabilities are necessary for the stated purpose of publishing videos to Douyin, they create a significant attack surface. The `SKILL.md` defines these powerful tools and their execution paths, making the skill vulnerable to potential prompt injection or command injection if the OpenClaw agent's input sanitization or sandboxing is insufficient. There is no explicit evidence of intentional malicious behavior (e.g., data exfiltration to unauthorized endpoints, backdoors, or obfuscated payloads) within the provided files, but the inherent power of the operations warrants a 'suspicious' classification.