Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Downloader tiktok videos

v1.0.4

Automatically downloads the latest video (or the N most recent) from a public TikTok account using yt-dlp. Use this skill whenever the user mentions TikTok,...

0· 465·1 current·1 all-time
bystx@stoxca
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the included artifacts: SKILL.md, advanced.md, and download_latest.py all implement TikTok video metadata/download functionality using yt-dlp and optionally ffmpeg. Declared dependencies (yt-dlp, optional ffmpeg) are proportional to the task.
Instruction Scope
Runtime instructions and the script only call yt-dlp/ffmpeg and perform local file operations. The docs explicitly instruct installing yt-dlp/ffmpeg system-wide (modifies host) and describe exporting browser cookies or using --cookies-from-browser; these actions involve sensitive session tokens and require user caution. This is expected for accessing restricted content but should be treated as sensitive.
Install Mechanism
There is no install spec that downloads arbitrary code; the skill is instruction-only plus a Python wrapper. The only installation advice is to pip/brew/apt install yt-dlp or ffmpeg (standard package sources). No download-from-personal-server or extract-from-URL steps are present.
Credentials
The skill requests no environment variables or credentials. It documents handling of cookies (user-provided cookie files or cookies-from-browser) which are sensitive but are user-supplied and not requested via env vars. No unrelated secrets are required.
Persistence & Privilege
always is false and the skill does not request persistent agent privileges or modify other skills/configs. It runs as an on-demand tool wrapping yt-dlp and does not attempt to persist credentials or change system-wide agent settings.
Assessment
This skill appears to do what it says: it wraps yt-dlp to fetch metadata and download TikTok videos. Before installing/using it: (1) review the Python script (it only shells out to yt-dlp) and run it in a sandbox/virtualenv/container if you want extra isolation; (2) install yt-dlp/ffmpeg from official package sources, not random URLs; (3) never share exported cookies or commit cookies.txt — using --cookies-from-browser exports active session tokens that are sensitive; (4) be aware of legal/ToS considerations when downloading content and avoid automating downloads from private accounts unless you control them; (5) avoid third-party cookie-exporting extensions and prefer built-in browser methods. If you want greater assurance, run the script without supplying cookies first and verify behavior on public accounts.

Like a lobster shell, security has layers — review code before you run it.

Tiktok downloadervk97f9b7gf26tmhnxgpg0a3cwps81y8ghlatestvk97f9b7gf26tmhnxgpg0a3cwps81y8gh

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Downloader TikTok Videos

Overview

Downloader TikTok Videos downloads the latest video (or multiple videos) from a public TikTok account using yt-dlp. Read this documentation fully before writing any code or running commands.

Prerequisites

This skill requires yt-dlp (and optionally ffmpeg for audio/video merging).

⚠️ The commands below modify your host environment (install packages system-wide). Run them only if yt-dlp is not already installed and you are comfortable doing so.

pip install -U yt-dlp --break-system-packages   # Linux system Python
# or
pip install -U yt-dlp                           # virtualenv / macOS
yt-dlp --version                                # verify install

Operation Types

This skill supports four operation types. Determine which one(s) the user needs:

  1. Quick Download — Download the latest video from an account
  2. Bulk Download — Download the N most recent videos
  3. Metadata Only — Retrieve info/stats without downloading the video
  4. Direct Video URL — Download from a specific video URL

Workflows

1. Quick Download — Latest Video from an Account

When to use: User provides a @username or profile URL

Steps:

  1. Normalize the username (strip @ if present)
  2. Build the profile URL: https://www.tiktok.com/@{username}
  3. Fetch metadata for the latest video (--playlist-items 1 --no-download)
  4. Show the user the video info (title, date, duration)
  5. Download with the optimal command
  6. Confirm success and provide the file path

Command:

yt-dlp \
  --playlist-items 1 \
  --format "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best" \
  --merge-output-format mp4 \
  --output "./%(uploader_id)s_%(upload_date)s_%(id)s.%(ext)s" \
  "https://www.tiktok.com/@{username}"

Verify the result:

ls -lh ./*.mp4

2. Bulk Download — N Most Recent Videos

When to use: User wants multiple videos

Steps:

  1. Ask how many videos (if not specified, default = 5)
  2. Build the command with --playlist-items 1-N
  3. Add --download-archive to avoid duplicates
  4. Download with progress output
  5. List downloaded files

Command:

yt-dlp \
  --playlist-items 1-{N} \
  --format "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best" \
  --merge-output-format mp4 \
  --download-archive ./tiktok_archive.txt \
  --output "./%(uploader_id)s/%(upload_date)s_%(id)s.%(ext)s" \
  "https://www.tiktok.com/@{username}"

3. Metadata Only

When to use: User wants video info without downloading

Read: references/metadata.md for all available fields and the full command

Quick command:

yt-dlp \
  --playlist-items 1 \
  --skip-download \
  --write-info-json \
  --print "%(uploader_id)s | %(upload_date)s | %(duration)ss | %(view_count)s views | %(title)s" \
  "https://www.tiktok.com/@{username}"

4. Direct Video URL

When to use: User provides a direct video URL

Command:

yt-dlp \
  --format "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best" \
  --merge-output-format mp4 \
  --output "./%(uploader_id)s_%(id)s.%(ext)s" \
  "{video_url}"

Common Errors

ErrorCauseFix
HTTP Error 403TikTok rate limitingAdd --sleep-interval 3 --max-sleep-interval 6
Unable to extractOutdated yt-dlppip install -U yt-dlp --break-system-packages
Private accountPrivate accountUse --cookies-from-browser chrome if logged in ⚠️ exports session cookies — keep them private
No video formatsGeo-restrictionAdd --geo-bypass
Sign in requiredRestricted contentProvide cookies via --cookies cookies.txt ⚠️ treat this file like a password
Merge requires ffmpegffmpeg missingapt-get install ffmpeg -y

⚠️ Cookie security note: Browser cookies exported via --cookies-from-browser or cookies.txt contain active session tokens. Never share these files, commit them to version control, or pass them to untrusted scripts. Delete them after use if no longer needed.

Username Normalization

# Accepts all these formats:
# @myaccount  →  myaccount
# myaccount   →  myaccount
# https://www.tiktok.com/@myaccount  →  myaccount

def normalize(input_str):
    if "tiktok.com/@" in input_str:
        return input_str.split("tiktok.com/@")[-1].split("/")[0]
    return input_str.lstrip("@").strip()

Reference Files

Load these references as needed:

references/metadata.md

  • When: Fetching metadata, working with JSON fields
  • Contains: All available yt-dlp fields, print format examples, JSON export

references/advanced.md

  • When: Watermark removal, cookies, proxy, custom headers
  • Contains: Advanced techniques, restriction bypass, full yt-dlp options

KBLICENSE.txt

  • When: Questions about usage rights or Terms of Service
  • Contains: Usage conditions, permitted and prohibited uses

Output Guidelines

  • Always display metadata before downloading (title, date, duration)
  • Confirm the downloaded file path
  • Show the final file size
  • On error, propose the fix directly

Example Queries

Quick download:

  • "Download the latest video from @someaccount"
  • "Get the latest TikTok post from myaccount"
  • "Download the last video from https://www.tiktok.com/@user"

Bulk download:

  • "Download the 5 latest videos from @user"
  • "Get the last 10 videos from @account"

Metadata:

  • "Give me the info on the latest video from @user"
  • "What is the title and date of the last post from @account"

Direct URL:

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…