TikTok/Douyin 创作流水线

This skill appears to implement what it claims (TikHub scraping, downloading, audio extraction, Whisper/MLX-Whisper transcription). Before installing or running it: - Review how you supply the TikHub API key — avoid hardcoding keys in the file; prefer passing via set_api_key at runtime or environment variables under your control. - The code uses subprocess with shell=True to launch background Whisper jobs (nohup). If you pass filenames or URLs containing untrusted characters, that could allow command injection. Only run the skill on files/inputs you trust or sanitize paths before use. - The skill spawns background processes and writes logs to /tmp; monitor for orphaned processes or large disk usage. - requirements.txt incorrectly includes 'ffmpeg' (not a pip package). Follow SKILL.md (brew apt-get or OS package manager) to install ffmpeg and the Python dependencies (requests, openai-whisper, mlx-whisper). - Consider inspecting the full set_api_key implementation (in scripts/tikhub.py) to confirm it does not persist secrets insecurely. - Legal/terms note: scraping/downloading videos and comments may violate service terms or local laws — ensure you have permission and are within terms of service. If you need to proceed but want to reduce risk: run the code in an isolated environment (container/VM), inspect or patch the subprocess usage to avoid shell=True (use list-argument subprocess.run without shell), and validate/sanitize all filenames and URLs before passing them to shell commands.