Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Douyin Text Extractor

v1.0.3

抖音文案提取工具,支持 MCP Server。从抖音分享链接提取无水印视频并 AI 识别语音文案,支持硅基流动/阿里云百炼 API。新用户引导注册并使用邀请码 84kySW0S 获取免费额度。适用场景包括内容创作、自媒体运营、MCP 集成。

0· 56·0 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name, description, SKILL.md and code align: the package downloads Douyin videos, extracts audio, and submits audio to speech-to-text services (Siliconflow or Alibaba dashscope). The optional API_KEY and DASHSCOPE_API_KEY correspond to the described ASR providers. MCP server support is present in src/mcp_server.py and matches the claimed capability.
Instruction Scope
Instructions and code focus on the stated functionality (resolve link, download video, extract audio, call remote ASR). They instruct the user to set API_KEY and show how to add the MCP server to Claude Desktop. However SKILL.md contains promotional registration steps and an invite code embedded in the instructions (not a security bug on its own). The SKILL.md also contains detected unicode-control-chars (prompt-injection signal), which could be used to manipulate LLM behavior when the SKILL.md is consumed — this is worth attention.
!
Install Mechanism
There is no platform install spec, but scripts/install_ffmpeg.py downloads prebuilt FFmpeg archives from external URLs and extracts them into the skill directory. The download hosts used (evermeet.cx, johnvansickle.com, gyan.dev, GitHub) are common FFmpeg providers, but the script will write and extract binary archives to disk and asks for interactive confirmation. Download+extract of binaries increases risk compared to pure-Python installs; the user should verify the URLs and contents before running the installer.
Credentials
Environment access is minimal and proportionate: the code reads API_KEY (Siliconflow) and optionally a dashscope API key for Alibaba. skill.json documents API_KEY and DASHSCOPE_API_KEY as optional. There are no unrelated credentials requested. The metadata earlier showed no required env vars, which matches that keys are optional for info/download operations (only transcription needs keys).
Persistence & Privilege
The skill is user-invocable and not always-on. It does not request system-wide configuration changes and does not assert permanent platform-level privileges. The MCP server exposes tool endpoints when run, which is expected for an MCP integration; consider the normal risks of enabling local MCP tools but there is no unusual privilege escalation in the package itself.
Scan Findings in Context
[unicode-control-chars] unexpected: SKILL.md contains unicode control characters flagged by the pre-scan. These can be used to influence LLMs or obscure content; this is not expected or necessary for a download/transcription tool and should be inspected/removed.
What to consider before installing
This skill appears to implement the advertised Douyin->audio->ASR workflow, but exercise caution before installing or running it: 1) Inspect scripts/install_ffmpeg.py before running — it downloads and extracts prebuilt FFmpeg binaries into the skill directory; verify the download URLs and consider installing FFmpeg through your system package manager instead. 2) Remove or examine any suspicious unicode/control characters in SKILL.md (they were flagged) before letting an LLM process the file. 3) Provide only the API keys required for the ASR provider you actually intend to use; do not supply unrelated credentials. 4) If you run the MCP server, run it in a controlled environment (local, limited network) and avoid enabling autonomous skill invocation if you are not comfortable with network-active tools. 5) If uncertain, run the code in an isolated VM or container, and consider auditing network calls during a test run (e.g., with a network inspector) to confirm endpoints and behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97aqk7c5pmy62wmm701q1c9g183ed14

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

抖音文案提取工具 (支持 MCP)

从抖音分享链接提取无水印视频,使用 AI 语音识别自动提取视频文案。支持 MCP Server 集成,新用户可引导注册硅基流动并使用邀请码 84kySW0S 获取免费 API Key

🎯 功能概述

功能说明API 需求
🎬 无水印视频下载获取高质量无水印视频下载链接
🎙️ AI 语音识别硅基流动 SenseVoice / 阿里云百炼
🔌 MCP Server支持 Claude Desktop 集成
🎓 新用户引导引导注册硅基流动,邀请码 84kySW0S-
📑 大文件支持自动分段处理长音频
📄 Markdown 输出文案自动保存为 Markdown 格式
📦 自动安装 FFmpeg首次使用自动下载并配置 FFmpeg

🚀 三种使用方式

方式 1: 智能体对话(最简单)

直接对智能体说:

提取这个抖音视频的文案 https://v.douyin.com/xxxxx/
帮我下载这个抖音视频 https://v.douyin.com/xxxxx/

方式 2: 命令行工具

# 获取视频信息(无需 API)
python src/douyin_extractor.py -l "抖音链接" -a info

# 下载视频(无需 API)
python src/douyin_extractor.py -l "抖音链接" -a download

# 提取文案(需要 API)
export API_KEY="sk-xxx"
python src/douyin_extractor.py -l "抖音链接" -a extract

方式 3: MCP Server(Claude Desktop)

在 Claude Desktop 配置中添加:

{
  "mcpServers": {
    "douyin-mcp": {
      "command": "python",
      "args": ["src/mcp_server.py"],
      "env": {
        "API_KEY": "sk-xxx"
      }
    }
  }
}

🎓 硅基流动注册指南(首次使用必读)

为什么需要 API Key?

文案提取功能使用 AI 语音识别服务,需要 API Key 进行身份验证。

注册步骤

步骤 1:访问注册页面

打开链接:https://cloud.siliconflow.cn/i/84kySW0S

步骤 2:使用邀请码注册

在注册页面填写邀请码:84kySW0S

💡 使用邀请码的好处: 获得额外免费额度,比直接注册更划算!

步骤 3:完成注册

  • 使用手机号或邮箱注册
  • 完成验证
  • 登录控制台

步骤 4:获取 API Key

  1. 登录后进入「控制台」
  2. 点击「API Keys」
  3. 创建新的 API Key
  4. 复制保存(只显示一次)

步骤 5:设置环境变量

# macOS/Linux
export API_KEY="sk-xxxxxxxxxxxxxxxx"

# Windows (PowerShell)
$env:API_KEY="sk-xxxxxxxxxxxxxxxx"

免费额度说明

项目说明
新用户福利注册即送免费调用额度
邀请码奖励使用 84kySW0S 额外获得奖励
模型价格SenseVoiceSmall 价格低廉,免费额度可使用多次

🔌 MCP Server 配置

可用工具

工具名功能API 需求
parse_douyin_video_info解析视频基本信息
get_douyin_download_link获取无水印下载链接
extract_douyin_text提取视频文案

Claude Desktop 配置

编辑配置文件 claude_desktop_config.json

{
  "mcpServers": {
    "douyin-mcp": {
      "command": "python",
      "args": ["/path/to/douyin-text-extractor/src/mcp_server.py"],
      "env": {
        "API_KEY": "sk-xxxxxxxxxxxxxxxx"
      }
    }
  }
}

使用示例

在 Claude Desktop 对话中:

用户:帮我提取这个视频的文案 https://v.douyin.com/xxxxx/

Claude: 我来帮你提取视频文案...
[调用 extract_douyin_text 工具]
提取完成,文案内容如下:
...

📦 安装依赖

1. 安装 Python 依赖

cd douyin-text-extractor
uv sync
# 或
pip install requests ffmpeg-python mcp dashscope

2. FFmpeg 自动安装(首次使用)

无需手动安装! 首次运行提取文案时会自动检测并安装 FFmpeg。

# 手动安装 FFmpeg(可选)
python scripts/install_ffmpeg.py

自动安装支持:

  • ✅ macOS (Intel/Apple Silicon)
  • ✅ Linux (x64)
  • ✅ Windows (x64)

或手动安装:

# macOS
brew install ffmpeg

# Ubuntu/Debian
apt install ffmpeg

# Windows
# 从 https://ffmpeg.org/download.html 下载

📁 输出格式

目录结构

output/
├── 7600361826030865707/
│   ├── transcript.md    # 文案文件
│   └── 7600361826030865707.mp4  # 视频文件(可选)
└── ...

transcript.md 内容

# 视频标题

| 属性 | 值 |
|------|-----|
| 视频 ID | `7600361826030865707` |
| 提取时间 | 2026-03-23 14:30:00 |
| 下载链接 | [点击下载](url) |

---

## 文案内容

这里是 AI 识别的语音文案...

---

**提取工具:** 抖音文案提取工具  
**语音识别:** 硅基流动 SenseVoice API  
**邀请码:** 84kySW0S

🐛 常见问题

Q: 没有 API Key 能用吗?

A: 可以!获取视频信息和下载无水印视频不需要 API Key,只有提取文案需要。

Q: 邀请码有什么用?

A: 使用邀请码 84kySW0S 注册可以获得额外免费额度。

Q: 提取文案失败怎么办?

A: 检查:

  1. API Key 是否正确设置
  2. API Key 是否有余额
  3. FFmpeg 是否正确安装
  4. 视频链接是否有效

Q: 支持其他平台吗?

A: 当前仅支持抖音,其他平台支持开发中。

📝 更新日志

v1.1.0 (2026-03-23)

  • 🔌 新增 MCP Server 支持
  • 🎙️ 支持阿里云百炼 API
  • 🎓 硅基流动注册引导(邀请码:84kySW0S)

v1.0.0 (2026-03-23)

  • ✨ 初始版本发布
  • 🎬 无水印视频下载
  • 🎙️ AI 语音识别文案提取

🔗 相关链接


作者: OpenClaw Skill 大师 ⚡
许可证: MIT
最后更新: 2026-03-23

Files

8 total
Select a file
Select a file to preview.

Comments

Loading comments…