Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

TikHub API 工具(KK版)

v1.1.0

TikHub API 多平台数据爬取工具,支持抖音/TikTok/B站等。当用户提到:(1) 爬取抖音/TikTok/B站视频或评论;(2) 获取用户信息/粉丝列表;(3) 批量下载无水印视频;(4) 抖音链接转文字(下载→音频→Whisper pipeline);(5) 调用 TikHub API。

0· 116·0 current·0 all-time
bykk.Tang@kk-kingkong

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kk-kingkong/tikhub-api-skill-kk.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "TikHub API 工具(KK版)" (kk-kingkong/tikhub-api-skill-kk) from ClawHub.
Skill page: https://clawhub.ai/kk-kingkong/tikhub-api-skill-kk
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tikhub-api-skill-kk

ClawHub CLI

Package manager switcher

npx clawhub@latest install tikhub-api-skill-kk
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (TikHub API crawler for Douyin/TikTok/Bilibili/etc.) aligns with the provided Python code and SKILL.md which call TikHub endpoints, download videos, fetch comments, and transcribe audio. However the registry metadata declares no required env vars while the code and docs clearly expect a TIKHUB_API_KEY (and optionally TIKHUB_BASE_URL). Also SKILL.md relies on an external tool (mcporter/MCP) and preconfigured MCP servers — that external dependency is not reflected in install metadata.
Instruction Scope
Runtime instructions and code operate within the expected scope (call TikHub API, curl video URLs, run ffmpeg/whisper). They instruct reading the user's workspace config and .env (~/.openclaw/workspace/config/mcporter.json and ~/.openclaw/workspace/.env) to obtain MCP settings and API key — which is necessary for operation but is sensitive. One example snippet hardcodes '/Users/kk/.openclaw/workspace/.env' which is suspicious (likely a leftover from the author's environment) and could cause the agent to attempt reading a specific user's path.
Install Mechanism
There is no automated install spec (instruction-only + included Python scripts). No remote archives or installers are fetched by the skill. A requirements.txt is present (requests, whisper variants, ffmpeg) — installing these is up to the user/environment. This is a low-risk install pattern compared to downloading arbitrary binaries.
Credentials
The skill needs a TikHub API key (TIKHUB_API_KEY) and optionally TIKHUB_BASE_URL — both reasonable and proportionate to its functionality. However, the registry metadata declares no required env vars while the code reads an API key from environment or from ~/.openclaw/workspace/.env. That mismatch is an inconsistency you should verify before use. The code searches ~/.openclaw/workspace/.env automatically, which means a locally stored secret will be read without an explicit registry declaration.
Persistence & Privilege
The skill does not request always:true, does not attempt to modify other skills or system-wide agent settings, and only writes typical output files (downloads, transcripts). It runs subprocesses (curl, ffmpeg, whisper) which is expected for this functionality and not itself a privilege escalation.
What to consider before installing
What to check before installing/using: - Confirm how you will provide the TikHub API key. The code expects TIKHUB_API_KEY (env or ~/.openclaw/workspace/.env), but the skill metadata does not declare it — supply the key via environment variables rather than leaving a plaintext .env in your home if possible. - Inspect SKILL.md and scripts for hard-coded paths. There is an example that opens '/Users/kk/.openclaw/workspace/.env' — likely leftover from the author; ensure no unwanted absolute paths are present or being used on your system. - Be aware the skill will download video files to disk and invoke ffmpeg and Whisper (CPU/GPU). Ensure you have the disk, compute capacity, and have installed the required tooling yourself (ffmpeg, whisper packages). requirements.txt lists ffmpeg (not a pip package) and multiple whisper packages — pick the ones you trust and need. - The skill relies on an external MCP (mcporter) server configuration referenced in ~/.openclaw/workspace/config/mcporter.json. If you don't run or trust that server, avoid executing MCP commands; the fallback Python SDK uses the TikHub API directly. - Network destinations: the skill talks to api.tikhub.dev and to the video host URLs it fetches — expected for this functionality. Confirm you are comfortable with calls to those endpoints and potential billing/usage (SKILL.md warns about a small balance and that some endpoints are paid). - Legal/ToS: scraping/downloading platform content may violate service terms or copyrights. Ensure you have the right to download/transcribe the content you target. If you want higher confidence, ask the author to: (1) update registry metadata to declare TIKHUB_API_KEY as a required env var, (2) remove or parameterize hard-coded user paths, and (3) provide clarity about MCP dependency and whether mcporter servers are remote/shared.

Like a lobster shell, security has layers — review code before you run it.

latestvk976y12tdts0fh6w2mar0252s583t9pw
116downloads
0stars
2versions
Updated 1mo ago
v1.1.0
MIT-0

TikTok Creator Pipeline (v6)

主方案:MCP(mcporter)— 零依赖,支持 7 大平台
备用方案:Python SDK(tikhub)— 仅在 MCP 不可用时使用

⚠️ 首次必读

MCP 配置(MCP 服务器已配置,无需额外操作)

MCP 配置在 ~/.openclaw/workspace/config/mcporter.json,已包含以下服务器:

Server平台工具数
tikhub-bilibiliB站41
tikhub-douyin抖音245
tikhub-tiktokTikTok204
tikhub-youtubeYouTube37
tikhub-xiaohongshu小红书71
tikhub-weibo微博64
tikhub-kuaishou快手33

API Key

存储在 ~/.openclaw/workspace/.envTIKHUB_API_KEY

计费说明

TikHub API 并非完全免费:

  • 余额$4.98(当前)
  • 缓存机制:结果缓存 24 小时,重复调用走缓存不收费
  • 价格参考:查询接口便宜(约几分钱),下载直链接口稍贵

核心操作(MCP 方案)

B站视频 → 完整字幕 + 内容分析

Step 1:获取视频信息

mcporter call tikhub-bilibili.bilibili_web_fetch_one_video bv_id="BV号"

Step 2:获取 AI 字幕(完整文字稿)

# 先获取字幕 URL
mcporter call tikhub-bilibili.bilibili_web_fetch_video_subtitle a_id="av号" c_id="cid"

# 下载字幕文件(JSON 格式,含时间戳)
curl -sL "字幕URL" -H "User-Agent: Mozilla/5.0" -o subtitle.json

Step 3:获取弹幕

mcporter call tikhub-bilibili.bilibili_web_fetch_video_danmaku cid="cid"

Step 4:获取下载直链(分段 m4s,需 ffmpeg 合并)

mcporter call tikhub-bilibili.bilibili_web_fetch_video_playurl bv_id="BV号" cid="cid"

抖音视频 → 文字稿

Step 1:从链接提取 aweme_id

# 短链接解析
curl -sI "https://v.douyin.com/xxx" | grep -i location

# 完整链接直接截取末尾数字

Step 2:获取视频信息

mcporter call tikhub-douyin.douyin_web_fetch_one_video aweme_id="aweme_id"

Step 3:获取下载直链(MP4)

mcporter call tikhub-douyin.douyin_app_v3_fetch_video_high_quality_play_url aweme_id="aweme_id"

Step 4:字幕/弹幕

# 字幕(需视频有字幕)
# 弹幕
mcporter call tikhub-douyin.douyin_web_fetch_one_video_danmaku item_id="aweme_id" duration=秒数 end_time=时间戳 start_time=0

TikTok 视频

mcporter call tikhub-tiktok.tiktok_web_fetch_one_video aweme_id="视频ID"
mcporter call tikhub-tiktok.tiktok_web_fetch_video_play_url aweme_id="视频ID"

YouTube 视频

mcporter call tikhub-youtube.youtube_web_fetch_one_video video_id="视频ID"
mcporter call tikhub-youtube.youtube_web_fetch_video_captions video_id="视频ID"

常用工具速查

平台视频信息获取

平台方法参数
B站tikhub-bilibili.bilibili_web_fetch_one_videobv_id
抖音tikhub-douyin.douyin_web_fetch_one_videoaweme_id
TikToktikhub-tiktok.tiktok_web_fetch_one_videoaweme_id
YouTubetikhub-youtube.youtube_web_fetch_one_videovideo_id
小红书tikhub-xiaohongshu.xiaohongshu_web_fetch_one_notenote_id

视频直链获取

平台方法说明
B站bilibili_web_fetch_video_playurl分段 m4s,需合并
抖音douyin_app_v3_fetch_video_high_quality_play_urlMP4 直链 ✅
TikToktiktok_web_fetch_video_play_urlMP4 直链
YouTubeyoutube_web_fetch_video_play_url直链

字幕/弹幕

平台字幕弹幕
B站bilibili_web_fetch_video_subtitlebilibili_web_fetch_video_danmaku
抖音❌ 大多无字幕douyin_web_fetch_one_video_danmaku
TikToktiktok_web_fetch_video_caption-
YouTubeyoutube_web_fetch_video_captions-

备用方案:Python SDK

仅在 MCP 调用失败时使用,或需要 SDK 特有功能时使用

安装依赖

pip3 install tikhub --user

API Key 配置

import os
os.environ["TIKHUB_API_KEY"] = "你的KEY"  # 从 .env 读取
os.environ["TIKHUB_BASE_URL"] = "https://api.tikhub.dev"

SDK vs MCP 对照

功能SDK 方法MCP 工具
抖音视频信息client.DouyinWeb.fetch_one_videodouyin_web_fetch_one_video
抖音无水印下载client.DouyinAppV3.fetch_one_videodouyin_app_v3_fetch_video_high_quality_play_url
B站视频信息❌ 不支持bilibili_web_fetch_one_video
查询余额client.TikHubUser.get_user_info()-

SDK 完整示例(抖音 → 文字稿)

import asyncio
import subprocess
import whisper
from tikhub import Client

async def douyin_to_text(aweme_id: str, output_dir="/tmp"):
    async with Client(api_key=os.getenv("TIKHUB_API_KEY"), base_url="https://api.tikhub.dev") as client:
        # 1. 获取视频信息
        info = await client.DouyinWeb.fetch_one_video(aweme_id=aweme_id)
        aweme = info["data"]["aweme_detail"]
        desc = aweme["desc"]

        # 2. 获取下载直链(SDK 无水印,MCP 只返回直链)
        dl_resp = await client.DouyinAppV3.fetch_one_video(aweme_id=aweme_id)
        video_url = dl_resp["data"]["video_data"]["video_url"]["url_list"][0]

        # 3. 下载视频
        video_path = f"{output_dir}/{aweme_id}.mp4"
        subprocess.run([
            "curl", "-sL", "-o", video_path, video_url,
            "-H", "User-Agent: Mozilla/5.0",
            "-H", "Referer: https://www.douyin.com/"
        ], check=True)

        # 4. 提取音频
        audio_path = f"{output_dir}/{aweme_id}.wav"
        subprocess.run([
            "ffmpeg", "-i", video_path, "-vn",
            "-acodec", "pcm_s16le", "-ar", "16000", "-ac", "1",
            audio_path, "-y"
        ], check=True)

        # 5. 转写(需安装 whisper)
        model = whisper.load_model("small", device="cpu")
        result = model.transcribe(audio_path, language="zh")

        return {"desc": desc, "text": result["text"]}

查询余额

python3 -c "
import asyncio
import httpx

async def check():
    key = open('/Users/kk/.openclaw/workspace/.env').read().split('TIKHUB_API_KEY=')[1].split('\n')[0]
    async with httpx.AsyncClient(timeout=10) as c:
        r = await c.get('https://api.tikhub.dev/api/v1/tikhub/user/get_user_info', headers={'Authorization': f'Bearer {key}'})
        d = r.json()
        print('余额:', d['user_data']['balance'], '美元')

asyncio.run(check())
"

已知问题

  1. B站下载直链是分段 m4s — 需要 ffmpeg 合并,非点开即用
  2. TikHub 不是完全免费 — 注意余额,建议善用缓存机制
  3. 抖音大部分视频无字幕 — 弹幕可作为内容参考
  4. MCP 响应较慢 — 首次连接需 5-10 秒,耐心等待

平台覆盖总结

平台信息字幕/弹幕下载直链备注
B站✅ AI字幕 + 弹幕✅ 分段直链最完整
抖音✅ 弹幕✅ MP4直链无字幕
TikTok✅ 字幕✅ MP4直链需梯子
YouTube✅ 字幕✅ 直链需梯子
小红书图文为主
微博视频为主
快手-

Comments

Loading comments...