lgCapture
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to do what it claims—download Douyin videos—but users should notice that it uses browser automation, network requests, and separately managed Playwright/Chromium dependencies.
This looks like a straightforward Douyin video-downloader skill. Before installing, make sure you are comfortable with it launching Chromium, visiting Douyin or supplied links, downloading video data, and requiring Playwright/Chromium dependencies that you must install from trusted sources.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A crafted or mistaken URL could cause the automated browser to visit an unintended site, though the artifacts do not show credential use, local file access, or exfiltration.
The skill intentionally drives a headless browser and may navigate to a user-provided URL when it contains a Douyin-looking substring. This is aligned with video downloading, but users should avoid feeding untrusted or non-Douyin URLs.
browser = await p.chromium.launch(headless=True, args=['--disable-blink-features=AutomationControlled']) ... full_url = url if 'douyin.com/video' in url else f"https://www.douyin.com/video/{video_id}"Use only legitimate Douyin video/share links and consider tightening host validation before relying on autonomous invocation.
The skill may fail until dependencies are installed, and users must choose trusted package/browser sources themselves.
The skill requires Playwright/Chromium according to SKILL.md, but the artifacts do not provide a pinned or managed installation path, leaving dependency source and version choices to the installer.
No install spec — this is an instruction-only skill.
Install Playwright and Chromium from trusted sources, preferably with pinned versions or a reviewed requirements file.