Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
TikTok视频审核
v1.1.0TikTok 视频 AI 审核技能。当用户发送 TikTok 链接并要求审核视频、生成审核报告时触发。功能包括：(1) TikTok 短链接解析，(2) yt-dlp 下载视频，(3) OpenCV 抽帧（前10秒10帧），(4) moviepy 音频提取分析（含逐秒 RMS），(5) Lingya AI（gem...
⭐ 0· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill claims to parse TikTok links, download videos, extract frames/audio and call an external LLM service for auditing—those capabilities are consistent with the code and SKILL.md. However the package metadata declares no required binaries or environment variables while SKILL.md and the script reference yt-dlp, OpenCV, moviepy and an external API; the metadata does not declare these dependencies or credentials, which is an incoherence and makes installation/usage unclear.
Instruction Scope
Runtime instructions ask the agent to run the supplied Python script against TikTok links and reference an external API endpoint. The SKILL.md contains a full API endpoint and a hard-coded API key; it does not document what exact data (frames, audio, or full video) will be uploaded to the external Lingya AI endpoint. Because video frames and audio can contain sensitive content or PII, the lack of explicit data-upload disclosures is a concern.
Install Mechanism
There is no install spec (instruction-only + included code file). That reduces installer risk, but the repository includes a large Python script and example output files while not declaring runtime Python package dependencies (OpenCV, moviepy, yt-dlp, requests/HTTP client, docx libs). The missing dependency/install information is a usability/security gap—users may run the code without understanding what will be installed or required.
Credentials
Metadata lists no required environment variables or credentials, but SKILL.md embeds a clear API key ('sk-0zy1YyzLaabc...') and a hard-coded yt-dlp path (/Users/apple/Library/...). Hard-coded secrets and per-user filesystem paths are inappropriate: credentials should not be embedded in code/README and should be declared as required env vars (and users should supply their own). The embedded API key appears to be real-looking and is not justified by the metadata—this is disproportionate and risky (possible credential leakage or misuse).
Persistence & Privilege
The skill does not request always:true, does not declare system-wide installs, and does not modify other skills' configs in the SKILL.md. It writes output files (audit reports, downloads) to a relative output directory, which is expected behavior for this functionality.
Scan Findings in Context
[hardcoded_api_key_in_SKILL.md] unexpected: SKILL.md contains an apparent API key 'sk-0zy1YyzLaabc...' and a Lingya AI endpoint. Credentials should not be hard-coded in documentation or shipped files; the skill metadata did not declare any required credential env vars.
[hardcoded_local_path] unexpected: The SKILL.md hard-codes a user-specific yt-dlp path: '/Users/apple/Library/Python/3.9/bin/yt-dlp'. A distributable skill should not rely on per-user absolute paths—this reduces portability and may cause unexpected behavior.
[missing_dependency_declarations] unexpected: The SKILL.md and code reference yt-dlp, OpenCV, moviepy and an external LLM API, but the registry metadata lists no required binaries or environment variables and there is no install spec. This mismatch is unexpected and should be remedied.
What to consider before installing
Do not run this skill as-is. Specific actions you should take before installing or using it:
- Treat the API key in SKILL.md as exposed: remove it and ask the author to move credentials to environment variables (e.g., LINGYA_API_KEY) or provide your own key. If that key is yours, rotate it immediately.
- Inspect scripts/tiktok_audit.py to confirm exactly what is sent to the external endpoint (frames, audio, or metadata). Only run if you accept that video/audio data will be uploaded to Lingya AI.
- Replace the hard-coded yt-dlp path with a configurable setting or ensure yt-dlp is on PATH. Install required Python packages (OpenCV, moviepy, requests, python-docx, etc.) in an isolated environment.
- Ask the maintainer to update registry metadata: declare required binaries, env vars, and an install spec or packaging instructions. If you cannot contact the author, run the code in an isolated environment (container/VM) and inspect network traffic during a dry run.
- If you plan to use this with sensitive videos, do not upload them to third-party APIs until you confirm the privacy/retention policy of the external service and replace the hard-coded key with your own account and access controls.Like a lobster shell, security has layers — review code before you run it.
latestvk97bpzhe8jeq5tncypwdpbtn8583w4sg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.