douyin-download

• Analyzed: May 16, 2026, 4:33 AM
• Findings: 1
• Version: 1.2.0
• Hash: b8bcd718ca46de4bbe9c49932698dd1b53bd3425d5a2a6b5fc55c0e39396d954
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a utility to download Douyin videos, extract audio, transcribe it using SiliconFlow API, and optionally segment the text using MiniMax API or OpenClaw's internal LLM. All operations, including network requests to Douyin, SiliconFlow, and MiniMax, and local file system operations (downloading, saving, deleting temporary files), are directly aligned with the stated purpose. The use of `child_process.spawn` with an array of arguments for `ffmpeg` and `curl` commands, along with `path.join` for file paths and basic sanitization of video titles, significantly mitigates common shell injection and path traversal vulnerabilities. There is no evidence of data exfiltration to unauthorized endpoints, persistence mechanisms, obfuscation, or prompt injection attempts against the OpenClaw agent in `SKILL.md`.