The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to orchestrate its workflow. It calls ffmpeg and ffprobe for video analysis and compression, pip to verify dependencies, and the f2 CLI for core downloading tasks. It also launches its own sub-scripts (e.g., download-v2.py, sync-following.py) to handle specialized logic. These executions are scoped to local tools and internal scripts required for the skill's functionality.
[EXTERNAL_DOWNLOADS]: The skill communicates with Douyin's official domains to fetch video files, covers, and metadata. These external calls are performed via the f2 framework and httpx, which are standard for this type of utility.
[CREDENTIALS_UNSAFE]: The login.py script facilitates the acquisition of Douyin session cookies. It opens a Chromium browser for the user to scan a QR code, extracts the resulting cookies, prints them to the console, and saves them in config/config.yaml. While cookies are sensitive, they are handled locally to maintain user sessions and are not sent to any untrusted remote servers.
[DYNAMIC_EXECUTION]: Browser automation scripts (login.py, manage-following.py) use Playwright's page.evaluate() method to run JavaScript in the context of the Douyin website. This is used to detect login states and extract user profile information from the DOM.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from Douyin, such as video descriptions and nicknames, to generate a local Web UI. The generate-data.py script uses json.dump to serialize this data into data.js, which effectively escapes characters and mitigates the risk of XSS or other injection attacks when the data is rendered in the static index.html viewer.

douyin-batch-download