Download Tool
v1.1.0支持下载 YouTube、TikTok、小红书、抖音等平台的视频。
⭐ 0· 135·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's declared description (video downloader) matches the code and instructions: both call a remote API to create download tasks and poll status. However, the registry metadata states no required config paths or credentials, while SKILL.md and the scripts require ~/.openclaw/config.json with a download_tool_api_key and optionally download_tool_base_url. That mismatch between metadata and runtime requirements is an incoherence that users should be aware of.
Instruction Scope
SKILL.md and the included scripts confine actions to the stated purpose: they read ~/.openclaw/config.json for an API key/base_url, POST the provided video URL to the service, poll status, and print an OSS download URL. The scripts load the entire JSON config file into memory (not just the single key), which could expose any other secrets present in that file to in-process memory, though the code only sends the API key and the video URL to the configured backend. No other system paths, env vars, or unexpected endpoints are referenced.
Install Mechanism
There is no install spec; the skill is instruction-plus-scripts only. No external archives or third-party packages are fetched at install time. This is a low-risk install mechanism.
Credentials
The skill legitimately requires an API key for the external service and optionally a base URL for self-hosting. Those are declared in SKILL.md (and used by the code) but the skill's registry metadata indicated no required config paths or credentials. Requiring users to place an API key in ~/.openclaw/config.json is reasonable for the service, but the metadata omission is a discrepancy and the API key is a sensitive secret that will be sent to the remote backend (as X-Api-Key).
Persistence & Privilege
The skill does not request always:true and does not modify agent-wide settings. It can be invoked autonomously (platform default), which is expected for skills. It does not attempt to change other skills' configs or system-wide files beyond reading ~/.openclaw/config.json.
Assessment
This skill delegates downloads to an external paid backend (https://www.datamass.cn). Before installing: (1) Understand that you must create and store an API key in ~/.openclaw/config.json — the code will send that key to the datamass service (X-Api-Key) and will also send the video URL; do not store other secrets in that file. (2) Expect billing and retention: the SKILL.md states downloaded files are stored in OSS for 24 hours and the service charges points — review pricing and privacy on the provider's site. (3) If you do not trust the remote service, you can self-host by setting download_tool_base_url, but verify the backend source code and deployment instructions first. (4) Note the registry metadata failed to declare the required config path/credential — that mismtach is not a showstopper but is a transparency issue; consider inspecting the included scripts yourself or running them locally to confirm behavior before supplying an API key.Like a lobster shell, security has layers — review code before you run it.
ai-toolvk978t6c8xsr0yefae1nnsmgaex837csqdouyinvk979nq24hetan6fktfph8365jd839mzrdownloadvk979nq24hetan6fktfph8365jd839mzrlatestvk97af0yk47ets4ga02vzp0r2as839f7mmediavk979nq24hetan6fktfph8365jd839mzrredbookvk979nq24hetan6fktfph8365jd839mzrshort-videovk979nq24hetan6fktfph8365jd839mzrtiktokvk979nq24hetan6fktfph8365jd839mzrvideovk979nq24hetan6fktfph8365jd839mzrvideo-downloadervk979nq24hetan6fktfph8365jd839mzrxiaohongshuvk979nq24hetan6fktfph8365jd839mzryoutubevk979nq24hetan6fktfph8365jd839mzr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.