抖音下载+语义分段

抖音无水印视频下载和文案提取工具

Security Scan

The skill mostly does what it claims (download Douyin videos, extract audio, call an ASR and perform segmentation) but has several mismatches between its manifest, README, and code (undeclared credentials and undeclared required binaries), which increases risk and warrants caution before installing.

Purpose & Capability

The name/description (Douyin no-watermark download + text extraction) matches the code: it fetches Douyin pages, extracts a no-watermark video URL, downloads video, extracts audio, calls an ASR, and performs semantic segmentation. However the SKILL.md claims it uses the OpenClaw built-in LLM for segmentation while the code actually calls an external MiniMax API (api.minimaxi.com). Also the code documents an optional MINIMAX_API_KEY environment variable that is not declared in the skill requirements.

Instruction Scope

SKILL.md instructs running node at a specific workspace path and states segmentation uses the built-in LLM, but the included douyin.js makes outgoing HTTP(S) requests to iesdouyin.com, siliconflow.cn, and api.minimaxi.com and spawns external processes (ffmpeg and curl). The instructions do not declare or warn about the external MiniMax call or the use of curl, giving the agent broader network and command execution scope than the manifest communicates.

Install Mechanism

There is no install spec (instruction-only with an included JS file). That keeps installation footprint small. However the code executes external binaries (ffmpeg and curl) and performs network I/O, so attackers could misuse those execution paths if keys are provided or the code is later modified.

Credentials

The registry metadata requires SILI_FLOW_API_KEY (used for ASR) which is coherent. But the code also reads MINIMAX_API_KEY (optional) and will send text to api.minimaxi.com if present — MINIMAX_API_KEY is not declared in requires.env. The code spawns curl to upload files and post JSON; these elevated network actions are proportional to the stated functionality only if the user expects their audio/text to be sent to those third-party services. The skill does not declare 'curl' as a required binary but uses it, and environment access and network transmission of audio/text to external APIs should be explicitly declared and approved by the user.

Persistence & Privilege

The skill is not always:true and does not request persistent or cross-skill configuration changes. It does write output files under /tmp by default but does not appear to modify other skills or global agent settings.

What to consider before installing

Before installing or supplying credentials, consider the following: - Missing declarations: the skill requires ffmpeg (declared) but the code also uses 'curl' (spawned) and an optional MINIMAX_API_KEY — 'curl' and MINIMAX_API_KEY are not declared in the skill metadata. Ask the publisher to add MINIMAX_API_KEY to requires.env and declare 'curl' as a required binary or change to a pure-Node HTTP implementation. - Credential scope: SILI_FLOW_API_KEY will be sent to https://api.siliconflow.cn with your audio file. If you set MINIMAX_API_KEY it will be sent to https://api.minimaxi.com. Only provide API keys you trust and that are scoped/limited; avoid sharing high-privilege or billing-sensitive keys. - Network & file-exfiltration risk: the skill uploads audio files to external services (ASR and segmentation). While that matches the declared purpose, it means sensitive audio/text could be transmitted. If you must process sensitive content, run the skill in an isolated environment (container or VM) or review/modify the code to remove external calls. - Behaviour mismatch: SKILL.md claims use of an internal LLM for segmentation but the code calls MiniMax. Confirm with the author which model/service will actually be used. - Operational recommendation: run the script in a sandboxed environment first, inspect/verify the code yourself (or ask for a signed/published source), and monitor outbound network requests during a test. If you don't want external calls beyond Silicon Flow, remove or disable the MiniMax call. - Legal/ethical note: downloading videos from platforms may violate terms of service or copyright — ensure you have rights to download and process the content. If you want, I can produce a short patch suggestion to (a) remove undeclared 'curl' usage by using Node HTTPS for API calls, (b) add explicit checks and warnings when MINIMAX_API_KEY is missing or present, and (c) surface required binaries/env variables clearly in SKILL.md.

douyin-download Skill

抖音无水印视频下载和文案提取工具。

功能

• 🎬 获取无水印视频下载链接
• 📥 下载抖音视频
• 🎙️ 从视频中提取语音文案（需要 API Key）
• ✂️ 语义分段（调用 OpenClaw 内置 LLM）

环境变量

• SILI_FLOW_API_KEY - 硅基流动 API 密钥（用于语音转文字）

获取 API Key: https://cloud.siliconflow.cn/

使用方法

获取视频信息

node /root/.openclaw/workspace/skills/douyin-download/douyin.js info "抖音分享链接"

下载视频

node /root/.openclaw/workspace/skills/douyin-download/douyin.js download "抖音链接" -o /tmp/douyin-download

提取文案（自动语义分段）

node /root/.openclaw/workspace/skills/douyin-download/douyin.js extract "抖音链接"

• 自动调用 Silicon Flow ASR 提取文字
• 自动调用 OpenClaw 内置 LLM 进行自然语义分段

跳过语义分段

node /root/.openclaw/workspace/skills/douyin-download/douyin.js extract "抖音链接" --no-segment