Skills/ClawHub/douyin-content-insights

douyin-content-insights@1.4.2

VERIFIED· install only

Publisher claims: "抖音KOL作品获取工具，输入抖音ID，通过怪奇API实时获取账号基础信息和作品内容列表（最多10000条/次）。当用户提到\"获取抖音作品\"、\"爬取抖音作品列表\"、\"查看抖音视频\"、\"抖音内容采集\"、\"抓取抖音作品\"时使用。提供5个能力：①关键词搜索（可按点赞/最新排序、时间窗、时长、图文类型筛选）②博主主页作品抓取 ③单条作品详情（按视频链接或 aweme_id 获取文案、互动与作者）④视频/图文评论抓取 ⑤实时热榜。输出结构化 JSON（含作者、互动数据、标签、链接）。当用户需要搜抖音视频、抓博主作品、看抖音评论、查抖音热榜、做竞品/对标账号监控、短视频选题调研、评论舆情分析、热点追踪、爆款挖掘时使用。触发词：抖音搜索、抖音热榜、抖音评论、抖音作品、博主作品、对标账号、抖音竞品分析、抖音数据分析、短视频运营、抖音舆情监控、抖音热点、舆情监控、热点追踪、爆款挖掘、douyin search、douyin content、douyin post、douyin hot search、douyin comments；评论需求/痛点挖掘见 demand-mining。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher why20261 · publishing for 59 daysInstalls 412Last detonated 3d ago
$clawhub install douyin-content-insights
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 92/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionSKILL.md:253 · File type combined with upload action — agent may exfiltrate local data files- 信封字段见 `assets/output_envelope.schema.json`。搜索、评论、热榜成功时 `results` 是数组。博主作品成功时 `results` 是对象，包含 `post`（作品数组）和 `user`（博主信息）。作品详情成功时 `results` 是一条作品对象。条目字段见 `assets/*_cli_resp.schema.json`；Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

No other findings across 4,206 lines in 43 files.

Cost to the agent

Instructions loaded
≈3,719 tok
1 file · 43 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.