douyin-download

抖音无水印视频下载和文案提取工具

Security Scan

The skill largely matches its stated purpose (download Douyin videos and transcribe/segment audio) but has multiple inconsistencies: it uses un-declared environment variables and an undeclared binary, and its SKILL.md claims use of a built-in LLM while the code calls an external MiniMax API.

Purpose & Capability

Name/description (download Douyin no-watermark video + extract text) aligns with the code: the script fetches video info, downloads video, extracts audio, sends audio to Silicon Flow for ASR, and (optionally) calls an LLM for semantic segmentation. However the SKILL.md claims segmentation uses the OpenClaw built-in LLM while the code calls an external MiniMax API if MINIMAX_API_KEY is set. Also SKILL.md lists only SILI_FLOW_API_KEY but the code references MINIMAX_API_KEY — an undeclared credential.

Instruction Scope

SKILL.md instructs running the included node script which will: (a) follow network redirects and access iesdouyin.com and video URLs, (b) download files to /tmp/douyin-download, (c) invoke ffmpeg, and (d) call external transcription and LLM endpoints. The code also spawns curl for POSTing audio and for LLM calls; curl is not listed in required binaries. The script reads process.env.MINIMAX_API_KEY in addition to the declared SILI_FLOW_API_KEY — SKILL.md does not document MINIMAX_API_KEY. These are scope/information mismatches and the use of an external LLM provider differs from the documentation's claim of using an internal LLM.

Install Mechanism

No install spec (instruction-only with bundled code) — lower install risk because nothing is downloaded at install time. But the shipped code will spawn system binaries (ffmpeg and curl) at runtime, and write files to /tmp. Because the code executes child processes and performs network calls, review of the included JS file is important before use.

Credentials

SKILL metadata declares only SILI_FLOW_API_KEY. The code legitimately uses SILI_FLOW_API_KEY for Silicon Flow ASR, which is expected. However the code also uses MINIMAX_API_KEY (for MiniMax API) if present — this env var is not declared in the skill metadata or SKILL.md usage section (only mentioned in JS comments). Requiring/using an extra credential without declaring it is disproportionate and surprising to users. Also the code will POST audio and text to external endpoints (siliconflow.cn and api.minimaxi.com), which is expected for the feature but worth noting.

Persistence & Privilege

No always:true; the skill is not force-installed and does not request elevated or persistent agent-level privileges. It does not modify other skill configs or system-wide agent settings. Its runtime behavior is limited to running the included script and contacting external services.

What to consider before installing

This skill is functionally consistent with a Douyin downloader/transcriber, but there are important mismatches you should consider before installing: - The SKILL.md declares only SILI_FLOW_API_KEY and ffmpeg, but the code also uses MINIMAX_API_KEY (undeclared) and spawns curl (an undeclared required binary). Expect the script to call external services at https://api.siliconflow.cn and https://api.minimaxi.com. - SKILL.md states it uses the OpenClaw built-in LLM for segmentation, but the code calls an external MiniMax API if MINIMAX_API_KEY is set. Ask the author to clarify whether segmentation uses an internal model or an external provider, and to document MINIMAX_API_KEY if required. - Before using, verify you have (or are willing to permit) ffmpeg and curl on the host, and that you are comfortable that audio and extracted text will be sent to the listed external endpoints. Consider creating/using API keys with limited scope or a disposable key. - If you need higher assurance, review the full douyin.js file locally (it was included) and run the script in a sandboxed environment (container or VM) to observe network calls and file writes. If the author provides an updated SKILL.md that documents MINIMAX_API_KEY and adds curl to required binaries (or modifies the code to use the platform's internal LLM as documented), that would reduce the current concerns.

douyin-download Skill

抖音无水印视频下载和文案提取工具。

功能

• 🎬 获取无水印视频下载链接
• 📥 下载抖音视频
• 🎙️ 从视频中提取语音文案（需要 API Key）
• ✂️ 语义分段（调用 OpenClaw 内置 LLM）

环境变量

• SILI_FLOW_API_KEY - 硅基流动 API 密钥（用于语音转文字）

获取 API Key: https://cloud.siliconflow.cn/

使用方法

获取视频信息

node /root/.openclaw/workspace/skills/douyin-download/douyin.js info "抖音分享链接"

下载视频

node /root/.openclaw/workspace/skills/douyin-download/douyin.js download "抖音链接" -o /tmp/douyin-download

提取文案（自动语义分段）

#SILI_FLOW_API_KEY="your-api-key"
node /root/.openclaw/workspace/skills/douyin-download/douyin.js extract "抖音链接"

• 自动调用 Silicon Flow ASR 提取文字
• 自动调用 OpenClaw 内置 LLM 进行自然语义分段

跳过语义分段

node /root/.openclaw/workspace/skills/douyin-download/douyin.js extract "抖音链接" --no-segment