Douyin To Photos

Build and maintain an Apple Shortcuts workflow that takes a Douyin share link, resolves a no-watermark MP4 URL via configurable backend APIs, saves the video...

Security Scan

The skill's files and runtime instructions align with its stated purpose (building an Apple Shortcuts flow that resolves Douyin share links via parser APIs and saves to Photos), but there are privacy and minor-declaration issues you should consider before using it.

Purpose & Capability

The name/description, SKILL.md, manifest, shortcut logic, and the included resolver script are coherent: resolving a Douyin share link via an API and saving the resulting MP4 to Photos legitimately requires an API call and a downloader. One inconsistency: the script requires curl and jq to run, but the skill metadata lists no required binaries — these dependencies are implicit rather than declared.

Instruction Scope

Runtime instructions stay within the stated workflow (collect link, validate domain, call parser API chain, download file, save to Photos, clean up). However, the resolver sends the user-supplied share URL to external parser endpoints (default: https://www.tikwm.com/api/ and any user-configured fallback). That is necessary for the parsing approach but means the link (and possibly metadata) will be transmitted to third-party services despite 'privacy-safe' language in the docs.

Install Mechanism

This is instruction-only with a small helper script; there is no installer nor remote archive download. That keeps the disk/persistence footprint minimal. The script will be executed locally if you run validation, so its behavior (curl/jq network calls) is transparent and auditable.

Credentials

The skill requests no environment variables, credentials, or platform secrets. That is proportionate. Note: the manifest exposes a configurable fallback API endpoint — if a user sets that to an untrusted server it could receive every processed share URL and returned video URLs, so user choice matters for privacy.

Persistence & Privilege

The skill is not marked always:true and does not request elevated platform permissions beyond network and Photos-add (as documented). It does not attempt to modify other skills or system-wide settings. The SKILL.md emphasizes temporary-file cleanup and no storage; those are followed by the included script and Shortcuts guide.

Assessment

This skill appears to do what it says: it builds a Shortcuts workflow that posts a Douyin share link to a parser API, downloads the returned MP4, saves it to Photos, and cleans up. Before installing or running it: 1) Be aware that the default parser (https://www.tikwm.com/api/) is a third-party service — your shared URL (and any associated metadata) will be sent to that service and could be logged; if you care about privacy, configure a trusted/self-hosted fallback or remove the default. 2) The included resolver script requires curl and jq (not listed in metadata) for local testing — install those if you plan to run the script. 3) Confirm you have the right to download/save the content and that this use complies with Douyin/TikTok terms and local law. 4) Because the owner and homepage are not provided, prefer to review the script and shortcut JSON yourself before use; the code is small and readable, so auditing it locally is feasible. If you want higher assurance, ask the publisher to declare required binaries and to document the privacy properties of the default parser or provide a vetted self-hosted parser option.

Use this skill to implement a one-tap Apple Shortcuts flow for authorized Douyin video archiving into Photos.

Hard Rules

• Process only links the user is allowed to download and store.
• Request only required permissions: network + Photos add-only.
• Keep all temporary files in Shortcuts temp folder and delete after import.
• Never persist user links, tokens, or media metadata outside local shortcut runtime.

Workflow

1. Accept input from Share Sheet (URL or text) or clipboard fallback.
2. Normalize and validate Douyin URL (douyin.com or iesdouyin.com).
3. Resolve playable MP4 via API provider chain:

• Primary: https://www.tikwm.com/api/
• Fallback: user-defined gateway API (for example self-hosted parser)

4. Download MP4 to temporary file.
5. Save to Photos (optionally target user-selected album).
6. Delete temporary file and report success/failure.

Included Resources

• scripts/fetch_douyin_no_watermark.sh: provider-chain URL resolver with timeout and structured errors.
• references/shortcut-build-guide.md: action-by-action Shortcuts build instructions.
• assets/skill-manifest.json: market-ready manifest template with parameterized options.

Integration Notes

• Share Sheet: enable URLs input type.
• Back Tap: configure a tiny launcher shortcut that reads clipboard and calls the main shortcut.
• Keep API base URL and album name configurable via shortcut dictionary values.

Validation

• Run URL resolver script with a test share link before wiring into Shortcuts.
• Test four scenarios: success, invalid link, API timeout, API quota/blocked.
• Confirm temporary media file is deleted in both success and failure paths.