dy-prohibited-word（抖音违禁词检测）

PassAudited by VirusTotal on May 9, 2026.

Overview

Type: OpenClaw Skill Name: dy-prohibited-word Version: 1.0.0 The skill bundle is a content compliance tool designed to detect prohibited words for the Douyin platform. It extracts text from various sources including local files (DOCX/TXT), URLs (using Playwright and BeautifulSoup), and images via OCR, then sends the content to a user-configured API endpoint (via `DY_SENSITIVE_WORD_API_URL`) for analysis. The Python script `scripts/check_sensitive_words.py` and the workflow instructions in `core_workflow.md` are well-structured, lack hardcoded malicious endpoints, and focus entirely on the stated purpose of content auditing and providing replacement suggestions.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Private draft copy, extracted file text, or webpage text may be transmitted to the configured API endpoint.

Why it was flagged

The script sends the user’s text content to the configured sensitive-word detection API for analysis.

Skill content

"content": content, "platform": "抖音", "source": "抖音违禁词查询-SkillHub"

Recommendation

Use only a trusted HTTPS endpoint, preferably one owned by the deployer or covered by an appropriate data-processing agreement.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may access local file paths or web pages the user provides and leave a plain-text optimized copy on disk.

Why it was flagged

The workflow uses local script execution to read provided files, fetch provided web pages, and create a result text file.

Skill content

先调用 `python scripts/check_sensitive_words.py --file=/path/to/file.txt --extract-only` ... `--url=https://example.com --extract-only` ... 写入文件 `./抖音_优化文案_{随机6位数字}.txt`

Recommendation

Only provide files and URLs intended for checking, and delete generated output files if they contain sensitive business copy.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Deployers must install and maintain these dependencies; browser/runtime setup can affect local environment security.

Why it was flagged

The skill depends on pinned Python packages and a Playwright Chromium browser installation for document and dynamic webpage extraction.

Skill content

python-docx==1.1.0 ... beautifulsoup4==4.12.3 ... playwright==1.58.0 ... playwright install chromium

Recommendation

Install dependencies from trusted package sources, keep Playwright/Chromium updated, and review the full script before production use.