Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
lgCapture
v1.0.0Automatically fetch Douyin videos from short, standard, or share links by extracting video ID and downloading via simulated iPhone browser.
⭐ 0· 435·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (fetch Douyin videos) align with the included Python scripts: both douyin.py and download.py parse Douyin links, use Playwright to load pages as an iPhone, extract video URLs and download them. No unrelated services, credentials, or binaries are requested.
Instruction Scope
SKILL.md describes the same steps implemented in the code (extract video ID, simulate iPhone via Playwright, read video.src or observe network responses, download and save). The code only accesses network resources required to fetch the page and video (douyin domains and related CDNs) and writes output to /tmp; it does not read local secrets, other files, or send data to unexpected endpoints.
Install Mechanism
This is instruction‑plus-code with no install spec. SKILL.md declares dependencies (playwright, chromium) but the package does not install them automatically. Installing Playwright separately will typically download a Chromium binary; that external download is normal but worth noting since it pulls code onto disk outside the skill bundle.
Credentials
The skill requires no environment variables, no credentials, and no config paths. The code uses standard libraries (requests, playwright) and only connects to Douyin/CDN URLs — so requested permissions are proportionate to the stated function.
Persistence & Privilege
Skill is user-invocable, not always-enabled. It does not modify other skills or system-wide configuration. Runtime behavior writes downloaded video files to /tmp (transient) and does not request persistent system privileges.
Assessment
This skill appears coherent and does what it says: load Douyin pages in a headless Chromium browser and download videos to /tmp. Before installing or running: (1) ensure you install Playwright and its browser binaries from the official source so you know what is being downloaded; (2) run the scripts in an isolated environment (container or VM) if you are concerned about network activity or handling untrusted links; (3) be aware of copyright/ToS implications for downloading content; (4) review or run the included code locally — it does not exfiltrate secrets or require credentials, but it will fetch remote content and save files to disk.Like a lobster shell, security has layers — review code before you run it.
latestvk972ab9de7zzmks3w2yx4h22m981tht1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.