Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Douyin Fetcher

v1.0.0

抖音视频获取模块。从抖音链接下载视频文件,支持短视频和 DASH 格式长视频。

0· 78·0 current·0 all-time
byDon Li@don068589

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for don068589/douyin-fetcher.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Douyin Fetcher" (don068589/douyin-fetcher) from ClawHub.
Skill page: https://clawhub.ai/don068589/douyin-fetcher
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install douyin-fetcher

ClawHub CLI

Package manager switcher

npx clawhub@latest install douyin-fetcher
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description claim to download Douyin videos; the included Python modules and SKILL.md show exactly that workflow: resolve short links, optionally call a TikHub API (if token configured), or generate a browser instruction for the agent to evaluate page JS and extract CDN URLs, then use curl/ffmpeg to download/merge. The code reads a per-skill config under ~/.openclaw/* which is reasonable for storing tokens and temp_dir. No unrelated credentials or services are requested.
Instruction Scope
SKILL.md instructs the agent to open pages via the platform 'browser' tool, evaluate JS in-page to capture resource URLs, then run curl/ffmpeg and optionally POST audio to a local ASR endpoint (http://localhost:PORT/asr). It also specifies file paths for temporary files and final transcript storage. These actions are expected for a downloader, but note: the skill will read and write files (temp_dir, final transcript locations) and will attempt to read ~/.openclaw/config.json as a configuration source — review these paths because they determine what files the skill can access or overwrite.
Install Mechanism
No install spec (instruction-only with included helper scripts). That minimizes supply-chain risk. The runtime relies on local binaries (curl, ffmpeg) and the platform's browser tool; the SKILL.md lists those prerequisites. No remote archive downloads or external installers are present in the bundle.
Credentials
The skill declares no required env vars or credentials, but it reads configuration files: ~/.openclaw/skills/douyin-config.json and ~/.openclaw/config.json (fallback). This is proportionate for storing a TikHub API token or temp_dir, but you should check those config files before installation to ensure they don't contain unrelated secrets. The optional TikHub API path will require a token in config; no other secret exfiltration code is present.
Persistence & Privilege
The skill does not request always:true and will not force inclusion. It generates temporary files and may move saved videos/transcripts to user-specified locations (as described). It does not modify other skills' configs or system-wide settings.
Assessment
This skill appears to do exactly what it says: download Douyin videos via a TikHub API (if configured) or by instructing the agent's browser tool to extract CDN URLs and then using local curl/ffmpeg to download/merge. Before installing, check the following: 1) Review ~/.openclaw/skills/douyin-config.json and ~/.openclaw/config.json (the skill will read these) and remove any unrelated secrets; the skill only needs a TikHub token here if you intend to use that API. 2) Confirm you want the agent to run browser(action=...) operations and that the agent has access to curl and ffmpeg on the host. 3) Note file paths in SKILL.md — temporary files and final transcripts will be written to the locations shown; update them if you need different storage. 4) The code imports a tikhub_api module when using that method; ensure that any TikHub client you use is trustworthy. 5) The skill will POST audio to a local ASR endpoint only if you follow that step — it will not phone-home to unknown third-party endpoints by default. If you want further assurance, provide the contents of your douyin-config.json (or confirm it only contains a tikhub token and harmless settings) so I can re-check whether the config read is safe.

Like a lobster shell, security has layers — review code before you run it.

latestvk975bza7zrbgtv56pkyzbb38es840x95
78downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Douyin Fetcher - 视频下载

**

快速开始

输入抖音链接 → 获取视频ID → 浏览器提取视频 URL → 下载(可能需合并)

Step 1: 解析链接

curl.exe -sL -o NUL -w "%{url_effective}" "https://v.douyin.com/xxx/"
# 输出: https://www.douyin.com/video/7612345678901234567

提取视频ID:7612345678901234567


Step 2: 打开浏览器

browser(action='open', profile='openclaw', url='https://www.douyin.com/video/{视频ID}')

等待 10-15 秒让页面加载完成。


Step 3: 提取视频 URL

3.1 调用方式

⚠️ act 操作必须用 request 嵌套格式,直接传 fn 会报错 request required

browser(action='act', targetId='页面ID', request={"kind": "evaluate", "fn": "JS代码"})

❌ 错误写法:browser(action='act', targetId='...', fn='JS代码') ✅ 正确写法:browser(action='act', targetId='...', request={"kind": "evaluate", "fn": "JS代码"})

3.2 提取 JS 代码

(() => {
    const entries = performance.getEntriesByType('resource');
    const videoEntries = entries.filter(e => {
        const name = e.name.toLowerCase();
        return name.includes('douyinvod') && 
               (name.includes('media-video') || name.includes('media-audio') || name.includes('video_mp4'));
    });
    return videoEntries.map(e => e.name);
})()

3.3 返回结果判断

情况A:DASH 分离流(常见)

[
  "https://v26-web.douyinvod.com/.../media-video-hvc1/...",
  "https://v26-web.douyinvod.com/.../media-audio-und-mp4a/..."
]
  • 需要分别下载视频流和音频流,然后合并
  • media-video → 视频流(无音频)
  • media-audio → 音频流

情况B:完整 MP4(部分视频)

[
  "https://v26-web.douyinvod.com/.../?mime_type=video_mp4&..."
]
  • 直接是完整视频,无需合并
  • 下载后直接可用

Step 4: 下载

情况A:分离流

# 下载视频流
curl.exe -L -H "Referer: https://www.douyin.com/" -o "/path/to/temp/douyin\video.mp4" "<视频流URL>"

# 下载音频流
curl.exe -L -H "Referer: https://www.douyin.com/" -o "/path/to/temp/douyin\audio.mp4" "<音频流URL>"

情况B:完整 MP4

curl.exe -L -H "Referer: https://www.douyin.com/" -o "/path/to/temp/douyin\video.mp4" "<完整URL>"

Step 5: 合并(仅保存完整视频时需要)

⚠️ 教训:DASH 分离流下载后已有独立的音频文件 audio.mp4,转录时直接传给 Whisper ASR 服务即可。合并只用于最终保存完整视频。

# 转录用:直接传给 Whisper ASR(无需处理)
curl.exe -X POST "http://localhost:PORT/asr" -F "audio_file=@/path/to/temp/douyin\audio.mp4"

# 保存用:需要完整视频时用 ffmpeg 合并
ffmpeg -i "/path/to/temp/douyin\video.mp4" -i "/path/to/temp/douyin\audio.mp4" -c:v copy -c:a aac "/path/to/temp/douyin\merged.mp4" -y

输出

文件说明
/path/to/temp/douyin\video.mp4视频流或完整视频
/path/to/temp/douyin\audio.mp4音频流(仅情况A)
/path/to/temp/douyin\merged.mp4合并后的完整视频(仅情况A)

常见问题

问题原因解决
JS 返回空数组页面未加载完等待 15-20 秒后重试,或先 snapshot 确认
下载 403URL 过期重新获取视频 URL
只有视频没有音频忘记下载音频流确保同时下载 media-audio
找不到 DASH 流该视频是完整 MP4扩展搜索条件,找包含 video_mp4 的 URL
browser act 报错 "request required"格式错误必须用 request={"kind": "evaluate", "fn": "..."} 嵌套格式

排查流程

提取 URL 失败时:

  1. 确认页面已加载

    browser(action='snapshot', targetId='页面ID')
    

    检查是否有视频播放器元素

  2. 扩大搜索范围

    // 查看所有 douyinvod 相关资源
    entries.filter(e => e.name.includes('douyinvod')).map(e => e.name)
    
  3. 检查视频时长

    • 长视频(>2分钟)可能需要更长时间加载

前置条件

  • curl 已安装
  • ffmpeg 已安装(用于视频合并)
  • 浏览器可用(openclaw profile)

已知限制

  1. 视频 URL 有时效性 — 获取后立即下载,不要拖延
  2. 需要浏览器 — openclaw profile 必须可用
  3. 图文笔记 — 链接格式为 /note/,不适用此模块
  4. 部分视频无分离流 — 直接是完整 MP4,无需合并

文件流转

临时目录

所有中间文件存放在 /path/to/temp/douyin\

阶段文件保留
下载video.mp4, audio.mp4, merged.mp4⚠️ 可选保留 merged.mp4
转录audio.wav❌ 转录后删除

最终位置

内容位置条件
转录稿/path/to/knowledge\transcripts\{主题}-完整转录.md必保存
视频/path/to/videos\tutorials\{主题}.mp4用户要求时保存

清理规则

转录完成后:

  1. 删除 audio.wav(转录中间产物)
  2. 保留或删除 video.mp4/audio.mp4/merged.mp4(根据用户需求)
  3. 如保存视频 → 移动到 /path/to/videos\ 后删除临时副本

浏览器处理

下载完成后关闭浏览器:

browser(action='stop')

释放资源,避免占用内存。


备用脚本

scripts/ 目录下有历史脚本,当前流程不再使用,保留备用:

脚本说明状态
fetcher.pyTikHub API 下载脚本已删除(TikHub API 已废弃且包已卸载)
browser_dom.py浏览器 DOM 提取脚本⚠️ 备用,需要 browser tool(沙盒环境不可用)

相关模块

  • douyin-transcriber:转录模块,用 Whisper 将视频转为文字
  • douyin-analyzer:分析模块,提取要点生成总结
  • orchestrator:编排模块,协调整个流程

Comments

Loading comments...