Back to skill
Skillv1.0.4
ClawScan security
Downloader tiktok videos · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 27, 2026, 11:16 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its stated purpose (wrapping yt-dlp to download TikTok videos); nothing in the files asks for unrelated credentials or hidden network endpoints, though it legitimately depends on user-installed yt-dlp/ffmpeg and may handle sensitive browser cookies if the user chooses to provide them.
- Guidance
- This skill appears to do what it says: it wraps yt-dlp to fetch metadata and download TikTok videos. Before installing/using it: (1) review the Python script (it only shells out to yt-dlp) and run it in a sandbox/virtualenv/container if you want extra isolation; (2) install yt-dlp/ffmpeg from official package sources, not random URLs; (3) never share exported cookies or commit cookies.txt — using --cookies-from-browser exports active session tokens that are sensitive; (4) be aware of legal/ToS considerations when downloading content and avoid automating downloads from private accounts unless you control them; (5) avoid third-party cookie-exporting extensions and prefer built-in browser methods. If you want greater assurance, run the script without supplying cookies first and verify behavior on public accounts.
Review Dimensions
- Purpose & Capability
- okName/description match the included artifacts: SKILL.md, advanced.md, and download_latest.py all implement TikTok video metadata/download functionality using yt-dlp and optionally ffmpeg. Declared dependencies (yt-dlp, optional ffmpeg) are proportional to the task.
- Instruction Scope
- noteRuntime instructions and the script only call yt-dlp/ffmpeg and perform local file operations. The docs explicitly instruct installing yt-dlp/ffmpeg system-wide (modifies host) and describe exporting browser cookies or using --cookies-from-browser; these actions involve sensitive session tokens and require user caution. This is expected for accessing restricted content but should be treated as sensitive.
- Install Mechanism
- okThere is no install spec that downloads arbitrary code; the skill is instruction-only plus a Python wrapper. The only installation advice is to pip/brew/apt install yt-dlp or ffmpeg (standard package sources). No download-from-personal-server or extract-from-URL steps are present.
- Credentials
- okThe skill requests no environment variables or credentials. It documents handling of cookies (user-provided cookie files or cookies-from-browser) which are sensitive but are user-supplied and not requested via env vars. No unrelated secrets are required.
- Persistence & Privilege
- okalways is false and the skill does not request persistent agent privileges or modify other skills/configs. It runs as an on-demand tool wrapping yt-dlp and does not attempt to persist credentials or change system-wide agent settings.